CVE-2022-20777

Cisco Enterprise NFV Infrastructure Software Vulnerabilities

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this advisory.

Affected

Cisco · Cisco Enterprise NFV Infrastructure Software

CVSS v3.1 NVD

9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0 NVD

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

11.07% chance of exploitation in the next 30 days, 96th percentile

Published

2022-05-04

Updated

2024-11-06

Proof-of-concept exploits (1)

• orangecertcc/security-research/security/advisories/GHSA-v56f-9gq3-rx3g

Security advisories

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-…

References

• CVE Record
• NVD entry