Riskcovery

CVE-2022-20929

State
Published
Severity
7.8 High
Published
Mar 8, 2023
Updated
Aug 3, 2024
Reserved
Nov 2, 2021

Read the record on cve.org

Description

A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, local attacker to provide an unauthentic upgrade file for upload. This vulnerability is due to insufficient cryptographic signature verification of upgrade files. An attacker could exploit this vulnerability by providing an administrator with an unauthentic upgrade file. A successful exploit could allow the attacker to fully compromise the Cisco NFVIS system.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hcisco

Weaknesses

  • CWE-347 Improper Verification of Cryptographic Signature

Affected Products

ProductVersions
Cisco Enterprise NFV Infrastructure SoftwareCisco
  • 3.5.1Affected
  • 3.5.2Affected
  • 3.6.1Affected
  • 3.6.2Affected
  • 3.6.3Affected
  • 3.7.1Affected
  • 3.8.1Affected
  • 3.9.1Affected
  • 3.9.2Affected
  • 3.10.1Affected
  • 3.10.2Affected
  • 3.10.3Affected
  • 3.11.1Affected
  • 3.11.2Affected
  • 3.11.3Affected
  • 3.12.1Affected
  • 3.12.2Affected
  • 3.12.3Affected
  • 3.12.1aAffected
  • 3.12.1bAffected
  • 4.1.1Affected
  • 4.1.2Affected
  • 4.2.1Affected
  • 4.4.2Affected
  • 4.4.1Affected
  • and 8 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.