CVE-2018-0433: Cisco SD-WAN Solution Command Injection Vulnerability
First published: Fri Oct 05 2018(Updated: )
A vulnerability in the command-line interface (CLI) in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. A successful exploit could allow the attacker to execute commands with root privileges.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Vedge 100 Firmware | <18.3.0 | |
| Cisco Vedge 100 | ||
| Cisco Vedge 1000 Firmware | <18.3.0 | |
| Cisco Vedge 1000 | ||
| Cisco Vedge 2000 Firmware | <18.3.0 | |
| Cisco Vedge 2000 | ||
| Cisco Vedge 5000 Firmware | <18.3.0 | |
| Cisco Vedge 5000 | ||
| Cisco Vbond Orchestrator | ||
| Cisco Vedge Cloud Router Platform | ||
| Cisco Vmanage Network Management System | ||
| Cisco Vsmart Controller |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-0433?
CVE-2018-0433 is a vulnerability in the command-line interface (CLI) in the Cisco SD-WAN Solution that could allow an authenticated, local attacker to inject arbitrary commands with root privileges.
What is the severity of CVE-2018-0433?
The severity of CVE-2018-0433 is rated as high.
How does CVE-2018-0433 affect Cisco products?
CVE-2018-0433 affects Cisco SD-WAN Solution, specifically vEdge and vManage platforms.
How can an attacker exploit CVE-2018-0433?
An attacker can exploit CVE-2018-0433 by injecting arbitrary commands into the command-line interface (CLI) with root privileges.
How can I fix CVE-2018-0433?
To fix CVE-2018-0433, update the affected Cisco SD-WAN Solution to version 18.3.0 or later. Refer to the Cisco Security Advisory for more information.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/author
- agent/weakness
- agent/severity
- agent/event
- agent/first-publish-date
- agent/description
- agent/tags
- vendor/cisco
- canonical/cisco vedge 100 firmware
- canonical/cisco vedge 100
- canonical/cisco vedge 1000 firmware
- canonical/cisco vedge 1000
- canonical/cisco vedge 2000 firmware
- canonical/cisco vedge 2000
- canonical/cisco vedge 5000 firmware
- canonical/cisco vedge 5000
- canonical/cisco vbond orchestrator
- canonical/cisco vedge cloud router platform
- canonical/cisco vmanage network management system
- canonical/cisco vsmart controller