CVE•Published 2022-09-30•1 article on news•7 live references•NVD data

CVE-2022-20775

Vulnerability data via CVEDB (Shodan)

CVSS v3.1

7.8

HIGH

EPSS percentile

Exploit Prediction Scoring System · top 4% of all CVEs

Description

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

Timeline

Published 2022-09-30

External references

NVD MITRE Exploit-DB GitHub PoC Sploitus trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2022-20775

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product

product:"Cisco Catalyst 8000v Edge"

All exposed Cisco Catalyst 8000v Edge instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Catalyst 8000v Edge"

HTTP body or banner mentions "Catalyst 8000v Edge" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2022-20775