CVE Vulnerability

CVE-2022-20844

A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC using a default static username and password combination. This vulnerability exists because the GUI is accessible on self-managed cloud installations or local server installations of Cisco vManage. An attacker could exploit this vulnerability by accessing the exposed GUI of Cisco SD-AVC. A successful exploit could allow the attacker to view managed device names, SD-AVC logs, and SD-AVC DNS server IP addresses.

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdavc-ZA5fpXX2 Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:cisco:sd-wan:20.7.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:sd-wan:20.3.4.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:sd-wan:20.3.4.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:sd-wan:20.3.5:*:*:*:*:*:*:*
cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*
Information

Published : 2022-09-30 07:15

Updated : 2022-10-05 04:21

NVD link : CVE-2022-20844

Mitre link : CVE-2022-20844

Products Affected
No products.
CWE
CWE-798