What’s Vulnerable › Vulnerabilities
CVE-2022-20655
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-11-15 · updated 2026-06-17
- Weakness: CWE-78
Description
A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this vulnerability by injecting commands during the execution of this process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privilege level of ConfD, which is commonly root.
Affected products
- Cisco Carrier Packet Transport: all versions
- Cisco Catalyst SD-WAN Manager: before 18.4.4; from 19.2.0 before 19.2.1 — fixed in 18.4.4, 19.2.1
- Cisco Enterprise NFV Infrastructure Software: before 3.12.1 — fixed in 3.12.1
- Cisco Ios Xe Catalyst Sd-Wan: before 16.10.2; from 16.12.0 before 16.12.1b; from 17.2.0 before 17.2.1r — fixed in 16.10.2, 16.12.1b, 17.2.1r
- Cisco Ios Xr Software: before 7.0.2; from 7.1.0 before 7.1.1 — fixed in 7.0.2, 7.1.1
- Cisco Network Services Orchestrator: before 4.3.9.1; from 4.4.0.0 before 4.4.5.6; from 4.5.0 before 4.5.7; from 4.6.0 before 4.6.1.7; from 4.7.0 before 4.7.1; from 5.1.0 before 5.1.0.1 — fixed in 4.3.9.1, 4.4.5.6, 4.5.7, 4.6.1.7, 4.7.1, 5.1.0.1
- Cisco SD-WAN vEdge router: before 18.4.4; from 19.2.0 before 19.2.1 — fixed in 18.4.4, 19.2.1
- Cisco Virtual Topology System: before 2.6.5 — fixed in 2.6.5
How to fix
Upgrade to a fixed version: Cisco Catalyst SD-WAN Manager 18.4.4, 19.2.1; Cisco Enterprise NFV Infrastructure Software 3.12.1; Cisco Ios Xe Catalyst Sd-Wan 16.10.2, 16.12.1b, 17.2.1r; Cisco Ios Xr Software 7.0.2, 7.1.1; Cisco Network Services Orchestrator 4.3.9.1, 4.4.5.6, 4.5.7, 4.6.1.7; Cisco SD-WAN vEdge router 18.4.4, 19.2.1; Cisco Virtual Topology System 2.6.5. Check the vendor advisory for mitigations.
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cli-cmdinj-4MttWZPB
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-confdcli-cmdinj-wybQDSSh
Get alerted when CVE-2022-20655 or the next vulnerability affects your stack