CVE-2022-20655: Cisco Carrier Packet Transport
High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.
A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this vulnerability by injecting commands during the execution of this process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privilege level of ConfD, which is commonly root.
Affected products
- Cisco Carrier Packet Transport: any version
- Cisco Catalyst SD-WAN Manager: before 18.4.4 (fixed in 18.4.4); from 19.2.0, before 19.2.1 (fixed in 19.2.1)
- Cisco Cisco Carrier Packet Transport: version 3.5 only; version 3.1 only; version 3.2 only; version 2.5 only; version 2.0 only; version 9.2.2 only; …
- Cisco Cisco Catalyst SD-WAN: affected versions not specified
- Cisco Cisco Catalyst SD-WAN Manager: affected versions not specified
- Cisco Cisco Enterprise Nfv Infrastructure Software: affected versions not specified
- Cisco Cisco IOS XE Catalyst SD-WAN: affected versions not specified
- Cisco Cisco IOS XR Software: affected versions not specified
- Cisco Cisco Network Services Orchestrator: affected versions not specified
- Cisco Cisco SD-WAN Vedge Router: affected versions not specified
- Cisco Cisco Ultra Gateway Platform: affected versions not specified
- Cisco Cisco Virtual Topology System VTS: affected versions not specified
- Cisco Enterprise Nfv Infrastructure Software: before 3.12.1 (fixed in 3.12.1)
- Cisco IOS XE Catalyst SD-WAN: before 16.10.2 (fixed in 16.10.2); from 16.12.0, before 16.12.1b (fixed in 16.12.1b); from 17.2.0, before 17.2.1r (fixed in 17.2.1r)
- Cisco IOS XR Software: before 7.0.2 (fixed in 7.0.2); from 7.1.0, before 7.1.1 (fixed in 7.1.1)
- Cisco Network Services Orchestrator: before 4.3.9.1 (fixed in 4.3.9.1); from 4.4.0.0, before 4.4.5.6 (fixed in 4.4.5.6); from 4.5.0, before 4.5.7 (fixed in 4.5.7); from 4.6.0, before 4.6.1.7 (fixed in 4.6.1.7); from 4.7.0, before 4.7.1 (fixed in 4.7.1); from 5.1.0, before 5.1.0.1 (fixed in 5.1.0.1)
- Cisco SD-WAN Vedge Router: before 18.4.4 (fixed in 18.4.4); from 19.2.0, before 19.2.1 (fixed in 19.2.1)
- Cisco Virtual Topology System: before 2.6.5 (fixed in 2.6.5)
Published 2024-11-15. Last modified 2026-06-17.