← Vulnerability feed

Vulnerability record · CVE-2022-20779 · published 4 May 2022

CVE-2022-20779: Cisco enterprise nfv infrastructure software improper access control vulnerability

Cisco · Enterprise Nfv Infrastructure Software

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this advisory.

8.8 CVSS 3.1 High EPSS 10% · top 4.4% CWE-284 · Improper access controlCWE-20 · Improper input validation
8.8CVSS 3.1 base score, v2 9.3
10%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/orangecertcc/security-research/security/advisories/GHSA-77vw-2pmg-q492 ExploitThird Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9 Vendor Advisory
https://github.com/orangecertcc/security-research/security/advisories/GHSA-77vw-2pmg-q492 ExploitThird Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9 Vendor Advisory

Track CVE-2022-20779 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2025-32433Erlang/OTP SSH server missing authentication allows remote code executionErlang/OTP SSH servers before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20 mishandle SSH protocol messages, letting an unauthenticated attacker execut…KEVEPSS 99%analysed9.9CVE-2022-20777Cisco enterprise nfv infrastructure software improper access control vulnerabilityMultiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM…EPSS 11%9.8CVE-2021-34746Cisco enterprise nfv infrastructure software improper authentication vulnerabilityA vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infrastructure Software (NFVIS) cou…EPSS 18%9.8CVE-2020-3470Cisco enterprise nfv infrastructure software memory buffer overflow vulnerabilityMultiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to exec…EPSS 4.8%9.8CVE-2019-1971Cisco enterprise nfv infrastructure software os command injection vulnerabilityA vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform …EPSS 3.6%9.8CVE-2019-1895Cisco enterprise nfv infrastructure software missing authentication for critical function vulnerabilityA vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an …EPSS 2.3%8.8CVE-2018-0279Cisco enterprise nfv infrastructure software improper input validation vulnerabilityA vulnerability in the Secure Copy Protocol (SCP) server of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote…EPSS 4.4%8.1CVE-2020-3478Cisco enterprise nfv infrastructure software improper input validation vulnerabilityA vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite ce…EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2022-20779), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.