What’s Vulnerable › Vulnerabilities

CVE-2022-20777: Cisco Enterprise NFV Infrastructure Software Vulnerabilities

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 11.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-05-04 · updated 2026-06-17
• Weakness: CWE-284

Description

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

• Cisco Enterprise NFV Infrastructure Software: before 4.7.1 — fixed in 4.7.1

How to fix

Upgrade to a fixed version: Cisco Enterprise NFV Infrastructure Software 4.7.1. Check the vendor advisory for mitigations.

References

• https://github.com/orangecertcc/security-research/security/advisories/GHSA-v56f-9gq3-rx3g
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9
• https://github.com/orangecertcc/security-research/security/advisories/GHSA-v56f-9gq3-rx3g
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9

Get alerted when CVE-2022-20777 or the next vulnerability affects your stack