A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this vulnerability by injecting commands during the execution of this process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privilege level of ConfD, which is commonly root.
History

Fri, 15 Nov 2024 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Cisco
Cisco carrier Packet Transport
Cisco catalyst Sd-wan Manager
Cisco enterprise Nfv Infrastructure Software
Cisco ios Xe Catalyst Sd-wan
Cisco ios Xr Software
Cisco network Services Orchestrator
Cisco sd-wan Vedge Router
Cisco virtual Topology System
CPEs cpe:2.3:a:cisco:carrier_packet_transport:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:sd-wan_vedge_router:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:virtual_topology_system:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe_catalyst_sd-wan:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr_software:*:*:*:*:*:*:*:*
Vendors & Products Cisco
Cisco carrier Packet Transport
Cisco catalyst Sd-wan Manager
Cisco enterprise Nfv Infrastructure Software
Cisco ios Xe Catalyst Sd-wan
Cisco ios Xr Software
Cisco network Services Orchestrator
Cisco sd-wan Vedge Router
Cisco virtual Topology System
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Fri, 15 Nov 2024 16:15:00 +0000

Type Values Removed Values Added
Description A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this vulnerability by injecting commands during the execution of this process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privilege level of ConfD, which is commonly root.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2024-11-15T15:56:42.927Z

Updated: 2024-11-15T21:00:58.460Z

Reserved: 2021-11-02T13:28:29.037Z

Link: CVE-2022-20655

cve-icon Vulnrichment

Updated: 2024-11-15T21:00:40.999Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-11-15T16:15:20.987

Modified: 2024-11-18T17:11:56.587

Link: CVE-2022-20655

cve-icon Redhat

No data.