What is CVE-2022-20780?

CVE-2022-20780 is a critical-severity vulnerability in Cisco Enterprise Nfv Infrastructure Software, classified under Improper Access Control. CVSS score: 9.9/10. Published 2022-05-04.

How severe is CVE-2022-20780?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Is CVE-2022-20780 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XXE in Cisco Enterprise Nfv Infrastructure Software

CVE-2022-20780

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data…

EPSS: 0.109 (95.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Cisco Enterprise Nfv Infrastructure Software — versions n/a
Cisco Enterprise_nfv_infrastructure_software

Weakness classification (CWE)

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
psirt@cisco.com (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-20780?: CVE-2022-20780 is a critical-severity vulnerability in Cisco Enterprise Nfv Infrastructure Software, classified under Improper Access Control. CVSS score: 9.9/10. Published 2022-05-04.
How severe is CVE-2022-20780?: Critical severity. CVSS v3 base score is 9.9 out of 10.
Is CVE-2022-20780 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.