cisco-sa-20180718-sd-wan-cmd-inject: Cisco SD-WAN Solution Command Injection Vulnerability
First published: Wed Jul 18 2018(Updated: )
A vulnerability in the vManage dashboard for the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system. The vulnerability is due to insufficient input validation of data parameters for certain fields in the affected solution. An attacker could exploit this vulnerability by configuring a malicious username on the login page of the affected solution. A successful exploit could allow the attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sd-wan-cmd-inject
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco SD-WAN firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20180718-sd-wan-cmd-inject?
The cisco-sa-20180718-sd-wan-cmd-inject vulnerability has been rated as a high severity issue.
How do I fix cisco-sa-20180718-sd-wan-cmd-inject?
To fix cisco-sa-20180718-sd-wan-cmd-inject, update the Cisco SD-WAN Solution to the latest version provided by Cisco.
Who is affected by cisco-sa-20180718-sd-wan-cmd-inject?
The cisco-sa-20180718-sd-wan-cmd-inject vulnerability affects users of the Cisco SD-WAN Solution.
What kind of attack can be executed using cisco-sa-20180718-sd-wan-cmd-inject?
An authenticated remote attacker can inject and execute arbitrary commands with vManage user privileges.
Is user authentication required to exploit cisco-sa-20180718-sd-wan-cmd-inject?
Yes, user authentication is required to exploit the cisco-sa-20180718-sd-wan-cmd-inject vulnerability.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/severity
- agent/references
- agent/weakness
- agent/title
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco sd-wan firmware