CVE-2022-20958

CVE-2022-20958 is a high-severity server-side request forgery (SSRF) vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application. This flaw, caused by insufficient input validation, allows an unauthenticated, remote attacker to send crafted HTTP requests. A successful exploit could lead to the disclosure of confidential information from the BroadWorks server and other networked devices. With a CVSS score of 8.8 (HIGH), the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required. While there is no known active exploitation, public exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered some community discussion and media coverage.