cisco-sa-20180718-sd-wan-cmd-inject: Cisco SD-WAN Solution Command Injection Vulnerability
A vulnerability in the vManage dashboard for the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system. The vulnerability is due to insufficient input validation of data parameters for certain fields in the affected solution. An attacker could exploit this vulnerability by configuring a malicious username on the login page of the affected solution. A successful exploit could allow the attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system.
There are no workarounds that address this vulnerability.
This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sd-wan-cmd-inject
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20180718-sd-wan-cmd-inject?
The cisco-sa-20180718-sd-wan-cmd-inject vulnerability has been rated as a high severity issue.
How do I fix cisco-sa-20180718-sd-wan-cmd-inject?
To fix cisco-sa-20180718-sd-wan-cmd-inject, update the Cisco SD-WAN Solution to the latest version provided by Cisco.
Who is affected by cisco-sa-20180718-sd-wan-cmd-inject?
The cisco-sa-20180718-sd-wan-cmd-inject vulnerability affects users of the Cisco SD-WAN Solution.
What kind of attack can be executed using cisco-sa-20180718-sd-wan-cmd-inject?
An authenticated remote attacker can inject and execute arbitrary commands with vManage user privileges.
Is user authentication required to exploit cisco-sa-20180718-sd-wan-cmd-inject?
Yes, user authentication is required to exploit the cisco-sa-20180718-sd-wan-cmd-inject vulnerability.