How to Fix CVE-2022-20696- An Unauthenticated Access Vulnerability in Cisco SD-WAN vManage Software

The network appliances manufacturer giant Cisco published an advisory on 7th September 2022 (Updated on 09 September 2022) in which Cisco detailed an unauthenticated access vulnerability in Cisco SD-WAN vManage Software. The vulnerability tracked as CVE-2022-20696 is a High severity vulnerability with a CVSS score of 7.5 out of 10. The vulnerability is actually lice in the Cisco SD-WAN vManage Software that could allow an unauthenticated, adjacent attacker who has access to the VPN0 logical network to also access the messaging service ports on an affected system. Since this flaw allows the attacker to view and inject messages into the messaging service by connecting to the messaging service ports of the affected system, which can cause configuration changes or cause the system to reload, it is most important to fix the CVE-2022-20696 vulnerability. Let’s see how to fix CVE-2022-20696, an unauthenticated access vulnerability in Cisco SD-WAN vManage Software, in this post.

A Short Note on Cisco SD-WAN vManage Software

Cisco SD-WAN vManage software is a centralized management system that allows you to manage your Cisco SD-WAN network from a single pane of glass. It provides you with the ability to configure and monitor all aspects of your network, including routers, switches, and WAN Edge devices. vManage also gives you the ability to view end-to-end network performance and troubleshoot any issues that may arise. In addition, vManage provides granular control over traffic policies and routing decisions, allowing you to optimize your network for specific applications and workloads.

Summary of CVE-2022-20696

This is an Unauthenticated Access Vulnerability in Cisco SD-WAN vManage Software, a centralized management system that allows you to manage your Cisco SD-WAN network. The flaw is due to the lack of sufficient protection mechanisms in the messaging server container ports on an affected system. This vulnerability could allow attackers to view and inject messages into the messaging service by connecting to the messaging service ports of the affected system, which can cause configuration changes or cause the system to reload. 

“To exploit this vulnerability, the attacker must be able to send network traffic to interfaces within the VPN0 logical network. This network may be restricted to protect logical or physical adjacent networks, depending on device deployment configuration.”

-Cisco

Cisco Products Vulnerable to CVE-2022-20696

Cisco advisory says that this Unauthenticated Access Vulnerability affects all Cisco devices if they are running a vulnerable version of Cisco SD-WAN vManage Software.

How to Fix CVE-2022-20696- An Unauthenticated Access Vulnerability in Cisco SD-WAN vManage Software?

Since the vulnerability lice in the messaging server container ports in vulnerable versions of Cisco SD-WAN vManage Software, attackers could exploit the flaw on all Cisco devices running a vulnerable version of Cisco SD-WAN vManage Software by connecting to the messaging service ports of the affected system. As a workaround, network administrators are advised to block ports 4222, 6222, and 8222, ports used by Cisco SD-WAN vManage Software messaging services. In addition to this, the vendor asked admins to block these ports on perimeter security deployments like firewalls and Cloud Controllers.

Cisco has released security patches to fix the CVE-2022-20696 vulnerability. Please refer to this table to see the vulnerable versions of Cisco SD-WAN vManage Software Release with recommended fixes. We recommend upgrading to an appropriate fixed software release, as shown in the below table.

How to Upgrade the vManage Software in Cisco SD-WAN?

Follow this simple procedure to upgrade the Cisco SD-WAN vManage Software.

Cisco Software Checker Utility

Cisco has published Cisco Software Checker service to search for Cisco Security Advisories for specific Cisco IOS, IOS XE, NX-OS, and NX-OS in ACI Mode software releases. We recommend to use this awesome tool from Cisco to ensure no advisories are skipped to action against the discovered known vulnerabilities.

For Example: if you want to check the advisories for Cisco Nexus 3000 Nexus Switch running 7.0 NX-OS. Select your Cisco Operating System, NX-OS Platform, NX-OS release versions from the dropdown. Click Continue button. Select the Advisory Impact Rating then click Continue button again. You will see a list of Security Advisories That Affect This Release.

Cisco Switcher Not-Affected By CVE-2022-20696:

Cisco clearly says that these products are safe and not affected by the CVE-2022-20696 flaw. Administrators can ignore taking action on these products.

• IOS XE SD-WAN Software
• SD-WAN vBond Orchestrator Software
• SD-WAN vEdge Cloud Routers
• SD-WAN vEdge Routers
• SD-WAN vSmart Controller Software

We hope this post will help you know how to fix CVE-2022-20696, an unauthenticated access vulnerability in Cisco SD-WAN vManage Software. Please share this post if you find this interested. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this.

• List Of Cisco Products Affected By Spring4Shell Vulnerability
• find the most secure messaging app
• How To Fix CVE-2021-22205, Unauthenticated RCE Vulnerability In GitLab
• How To Fix CVE-2022-20759- A Privilege Escalation Vulnerability In Cisco ASA And Cisco FTD
• 15 Key Factors to Find the Most Secure Messaging App!