CVE-2022-20789

A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to write arbitrary files on the affected system. This vulnerability is due to improper restrictions applied to a system script. An attacker could exploit this vulnerability by using crafted variables during the execution of a system upgrade. A successful exploit could allow the attacker to overwrite or append arbitrary data to system files using root-level privileges.

• CWE-73
• CWE-610

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-arb-write-74QzruUUVendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-arb-write-74QzruUUVendor Advisory

Published

Apr 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-20783A vulnerability in the packet processing functionality of Ci…7.5
• CVE-2022-20784A vulnerability in the Web-Based Reputation Score (WBRS) eng…5.3
• CVE-2022-20785On April 20, 2022, the following vulnerability in the ClamAV…7.5
• CVE-2022-20786A vulnerability in the web-based management interface of Cis…8.1
• CVE-2022-20787A vulnerability in the web-based management interface of Cis…6.8
• CVE-2022-20788A vulnerability in the web-based management interface of Cis…6.1
• CVE-2022-2079Cross-site Scripting (XSS) - Stored in GitHub repository noc…5.4
• CVE-2022-20790A vulnerability in the web-based management interface of Cis…6.5
• CVE-2022-20791A vulnerability in the database user privileges of Cisco Uni…6.5
• CVE-2022-20792A vulnerability in the regex module used by the signature da…7.8
• CVE-2022-20793A vulnerability in pairing process of Cisco TelePresenc…6.8
• CVE-2022-20794Multiple vulnerabilities in the web engine of Cisco TelePres…4.7