CVE-2022-20908

cisco nexus dashboard

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-20908

Katalog CVE

CVSS 6.7 · Medium EPSS 0,22%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada cisco nexus dashboard. Skor CVSS 3.1 6.7 (Medium) menurut NVD.

Deskripsi (NVD)

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities by authenticating as the rescue-user and executing vulnerable CLI commands using a malicious payload. A successful exploit could allow the attacker to elevate privileges to root on an affected device.

Rincian

Terbit di NVD
22 Juli 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
6.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-20: Improper Input Validation
EPSS (30 hari)
0,22% peluang dieksploitasi; lebih tinggi dari 11,1% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
cisco nexus dashboard Versi 2.0 hingga sebelum 2.2\(1e\)

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.