cisco nexus-dashboard CVE-2022-20906 is a vulnerability in Cisco Nexus Dashboard
Published on July 22, 2022

Cisco Nexus Dashboard Privilege Escalation Vulnerabilities
Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities by authenticating as the rescue-user and executing vulnerable CLI commands using a malicious payload. A successful exploit could allow the attacker to elevate privileges to root on an affected device.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2022-20906 is exploitable with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

What is a TOCTTOU Vulnerability?

The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state. This weakness can be security-relevant when an attacker can influence the state of the resource between check and use. This can happen with shared resources such as files, memory, or even variables in multithreaded programs.

CVE-2022-20906 has been classified to as a TOCTTOU vulnerability or weakness.


Products Associated with CVE-2022-20906

Want to know whenever a new CVE is published for Cisco Nexus Dashboard? stack.watch will email you.

Cisco Nexus Dashboard
 

Affected Versions

Cisco Nexus Dashboard Version n/a is affected by CVE-2022-20906

Exploit Probability

EPSS
0.02%
Percentile
5.58%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.