PT-2022-2505 · Cisco · Cisco Sd-Wan Vmanage

Published 2022-05-04 · Updated 2023-10-16 · CVE-2022-20734

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software (affected versions not specified)

Description A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected system. This issue is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this by accessing the vshell of an affected system, potentially allowing them to read sensitive information on the underlying operating system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

CWE-497

Related Identifiers

BDU:2022-02915

CVE-2022-20734

Affected Products

Cisco Sd-Wan Vmanage

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmge-infodc-WPSkAMhp · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02915 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20734 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20734 · Vendor Advisory
• https://t.me/cibsecurity/41946 · Telegram Post
• https://t.me/cvenotify/59524 · Telegram Post