Vulnerability Description
A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitrary files from the file system of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary file path information when using commands in the CLI of an affected device. A successful exploit could allow the attacker to delete arbitrary files from the file system of the affected device.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Sd-Wan Vbond Orchestrator | < 18.4.5 |
| Cisco | Sd-Wan Vmanage | < 18.4.5 |
| Cisco | Sd-Wan Vsmart Controller | < 18.4.5 |
| Cisco | Ios Xe Sd-Wan | < 16.10.1 |
| Cisco | Sd-Wan | < 18.4.5 |
| Cisco | 1100-4G Integrated Services Router | - |
| Cisco | 1100-6G Integrated Services Router | - |
| Cisco | 1100 Integrated Services Router | - |
| Cisco | Vedge 100 | - |
| Cisco | Vedge 1000 | - |
| Cisco | Vedge 100B | - |
| Cisco | Vedge 100M | - |
| Cisco | Vedge 2000 | - |
| Cisco | Vedge 5000 | - |
Related Weaknesses (CWE)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aVendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aVendor Advisory
FAQ
What is CVE-2022-20850?
CVE-2022-20850 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitrary files from the file system of an affec...
How severe is CVE-2022-20850?
CVE-2022-20850 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-20850?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Sd-Wan Vbond Orchestrator, Cisco Sd-Wan Vmanage, Cisco Sd-Wan Vsmart Controller, Cisco Ios Xe Sd-Wan, Cisco Sd-Wan.