CVE-2022-20739 (CNNVD-202204-3457)
中文标题:
Cisco SD-WAN vManage Software 安全漏洞
英文标题:
Cisco SD-WAN vManage Software Privilege Escalation Vulnerability
漏洞描述
中文描述:
Cisco SD-WAN vManage Software是美国思科（Cisco）公司的一款用于SD-WAN（软件定义广域网络）解决方案的管理软件。 Cisco SD-WAN vManage Software 存在安全漏洞，该漏洞源于当低权限用户在受影响的系统上运行特定命令时会执行由 root 用户利用的文件。攻击者利用此漏洞可以通过将任意命令作为低权限用户注入特定文件，然后等待管理员用户执行特定命令。以下产品和版本受到影响：18.3 及之前版本、18.4、19.2、20.1、20.3、20.4、20.5、20.6 和 20.7 版本。
英文描述:
A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the root user. The attacker must be authenticated on the affected system as a low-privileged user to exploit this vulnerability. This vulnerability exists because a file leveraged by a root user is executed when a low-privileged user runs specific commands on an affected system. An attacker could exploit this vulnerability by injecting arbitrary commands to a specific file as a lower-privileged user and then waiting until an admin user executes specific commands. The commands would then be executed on the device by the root user. A successful exploit could allow the attacker to escalate their privileges on the affected system from a low-privileged user to the root user.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco SD-WAN vManage | n/a | - | - |
cpe:2.3:a:cisco:cisco_sd-wan_vmanage:n_a:*:*:*:*:*:*:*
|
| cisco | catalyst_sd-wan_manager | 20.7 | - | - |
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.7:*:*:*:*:*:*:*
|
| cisco | sd-wan_vmanage | * | - | - |
cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.1 (cna)
HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2022-20739 |
2025-11-11 15:21:15 | 2025-11-11 07:37:15 |
| NVD | nvd_CVE-2022-20739 |
2025-11-11 14:58:16 | 2025-11-11 07:45:32 |
| CNNVD | cnnvd_CNNVD-202204-3457 |
2025-11-11 15:10:52 | 2025-11-11 07:57:15 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202204-3457
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 3
- data_sources: ['cve'] -> ['cve', 'nvd']