by Kastro
Paper/Archive/CVE-2022-20779

CVE-2022-20779

Cisco Cisco Enterprise NFV Infrastructure Software — Cisco Enterprise NFV Infrastructure Software Vulnerabilities

EPSS 10%CVSS 9.9
critical.is priorityof 100
49
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 95.8.958 × 2019.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this advisory.

Affected

ProductAffectedFixed inSource
Cisco Enterprise NFV Infrastructure Softwaren/a–CNA

Scores by source

cisco (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorytools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9refgithub.com/orangecertcc/security-research/security/advisories/GHSA-77vw-2pmg-q492