CVE-2022-20734: cisco catalyst_sd-wan_manager
Vulnerability summary
CVE-2022-20734 is a medium (CVSS 4.9) vulnerability in cisco catalyst_sd-wan_manager. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14% of scored vulnerabilities.
Timeline
- 04-05-2022PublishedVulnerability first disclosed.
- 06-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
14%
Versus all other CVEs
30-day change
0.00 pp
From 0.24% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-497Exposure of Sensitive System Information to an Unauthorized Control SphereThe product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Cisco2 products
- catalyst_sd-wan_manager≥ 20.6, < 20.6.3 | ≥ 20.7, < 20.7.2
- cisco sd-wan vmanagen/a
1 vendor · 2 products
References
1 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmge-infodc-WPSkAMhpVendor AdvisoryX Refsource CISCO