CVE-2020-3266: Cisco SD-WAN Solution Command Injection Vulnerability
A vulnerability in the CLI of Cisco SD-WAN Solution software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. A successful exploit could allow the attacker to execute commands with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-3266?
CVE-2020-3266 is a vulnerability in the CLI of Cisco SD-WAN Solution software that allows an authenticated local attacker to execute arbitrary commands with root privileges.
How does CVE-2020-3266 affect Cisco SD-WAN Solution software?
CVE-2020-3266 affects Cisco SD-WAN Solution software versions up to and including 19.2.2.
What is the severity of CVE-2020-3266?
CVE-2020-3266 has a severity rating of 7.8 (high).
How can an attacker exploit CVE-2020-3266?
An attacker can exploit CVE-2020-3266 by authenticating to the affected device's CLI and injecting arbitrary commands.
Is there a fix available for CVE-2020-3266?
Yes, Cisco has released a security advisory with information on how to mitigate CVE-2020-3266. Please refer to the advisory for more details.