Sign-up

ID

VAR-202209-0377


CVE

CVE-2022-20696


TITLE

Cisco Systems  Catalyst SD-WAN Manager  and  Cisco SD-WAN vManage  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-018492

DESCRIPTION

A vulnerability in the binding configuration of Cisco SD-WAN vManage Software containers could allow an unauthenticated, adjacent attacker who has access to the VPN0 logical network to also access the messaging service ports on an affected system. This vulnerability exists because the messaging server container ports on an affected system lack sufficient protection mechanisms. An attacker could exploit this vulnerability by connecting to the messaging service ports of the affected system. To exploit this vulnerability, the attacker must be able to send network traffic to interfaces within the VPN0 logical network. This network may be restricted to protect logical or physical adjacent networks, depending on device deployment configuration. A successful exploit could allow the attacker to view and inject messages into the messaging service, which can cause configuration changes or cause the system to reload. Cisco Systems Catalyst SD-WAN Manager and Cisco SD-WAN vManage Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2022-20696 // JVNDB: JVNDB-2022-018492 // VULHUB: VHN-405249 // VULMON: CVE-2022-20696

AFFECTED PRODUCTS

vendor:ciscomodel:catalyst sd-wan managerscope:gteversion:20.7

Trust: 1.0

vendor:ciscomodel:sd-wan vmanagescope:ltversion:20.6.4

Trust: 1.0

vendor:ciscomodel:catalyst sd-wan managerscope:ltversion:20.9.1

Trust: 1.0

vendor:シスコシステムズmodel:cisco sd-wan vmanagescope:eqversion:20.6.4

Trust: 0.8

vendor:シスコシステムズmodel:catalyst sd-wan managerscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-018492 // NVD: CVE-2022-20696

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-20696
value: HIGH

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20696
value: HIGH

Trust: 1.0

NVD: CVE-2022-20696
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202209-421
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2022-20696
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20696
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-20696
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-018492 // CNNVD: CNNVD-202209-421 // NVD: CVE-2022-20696 // NVD: CVE-2022-20696

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-284

Trust: 1.0

problemtype:others (CWE-Other) [NVD evaluation ]

Trust: 0.8

problemtype:CWE-668

Trust: 0.1

sources: VULHUB: VHN-405249 // JVNDB: JVNDB-2022-018492 // NVD: CVE-2022-20696

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202209-421

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202209-421

PATCH

title:cisco-sa-vmanage-msg-serv-AqTup7vsurl:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-msg-serv-AqTup7vs

Trust: 0.8

title:Cisco SD-WAN vManage Software Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=247138

Trust: 0.6

title:Cisco: Cisco SD-WAN vManage Software Unauthenticated Access to Messaging Services Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-vmanage-msg-serv-AqTup7vs

Trust: 0.1

title:The Registerurl:https://www.theregister.co.uk/2022/09/08/cisco_routers_vulnerability/

Trust: 0.1

sources: VULMON: CVE-2022-20696 // JVNDB: JVNDB-2022-018492 // CNNVD: CNNVD-202209-421

EXTERNAL IDS

db:NVDid:CVE-2022-20696

Trust: 3.4

db:JVNDBid:JVNDB-2022-018492

Trust: 0.8

db:AUSCERTid:ESB-2022.4438

Trust: 0.6

db:CNNVDid:CNNVD-202209-421

Trust: 0.6

db:VULHUBid:VHN-405249

Trust: 0.1

db:VULMONid:CVE-2022-20696

Trust: 0.1

sources: VULHUB: VHN-405249 // VULMON: CVE-2022-20696 // JVNDB: JVNDB-2022-018492 // CNNVD: CNNVD-202209-421 // NVD: CVE-2022-20696

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-vmanage-msg-serv-aqtup7vs

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-20696

Trust: 0.8

url:https://www.auscert.org.au/bulletins/esb-2022.4438

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-20696/

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-405249 // VULMON: CVE-2022-20696 // JVNDB: JVNDB-2022-018492 // CNNVD: CNNVD-202209-421 // NVD: CVE-2022-20696

SOURCES

db:VULHUBid:VHN-405249
db:VULMONid:CVE-2022-20696
db:JVNDBid:JVNDB-2022-018492
db:CNNVDid:CNNVD-202209-421
db:NVDid:CVE-2022-20696

LAST UPDATE DATE

2024-08-14T14:31:00.018000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-405249date:2022-09-13T00:00:00
db:VULMONid:CVE-2022-20696date:2022-09-08T00:00:00
db:JVNDBid:JVNDB-2022-018492date:2023-10-20T03:15:00
db:CNNVDid:CNNVD-202209-421date:2023-07-24T00:00:00
db:NVDid:CVE-2022-20696date:2023-11-07T03:42:39.143

SOURCES RELEASE DATE

db:VULHUBid:VHN-405249date:2022-09-08T00:00:00
db:VULMONid:CVE-2022-20696date:2022-09-08T00:00:00
db:JVNDBid:JVNDB-2022-018492date:2023-10-20T00:00:00
db:CNNVDid:CNNVD-202209-421date:2022-09-07T00:00:00
db:NVDid:CVE-2022-20696date:2022-09-08T13:15:08.867