cisco-sa-sd-wan-vmanage-4TbynnhZ: Cisco SD-WAN vManage Software Vulnerabilities

Q: What is the severity of cisco-sa-sd-wan-vmanage-4TbynnhZ?

The severity of cisco-sa-sd-wan-vmanage-4TbynnhZ is critical due to the potential for remote code execution and unauthorized access.

Q: How do I fix cisco-sa-sd-wan-vmanage-4TbynnhZ?

To fix cisco-sa-sd-wan-vmanage-4TbynnhZ, update the Cisco SD-WAN vManage Software to a patched version as recommended in the security advisory.

Q: Who is affected by cisco-sa-sd-wan-vmanage-4TbynnhZ?

Organizations using vulnerable versions of Cisco SD-WAN vManage Software, specifically those listed in the advisory, are affected by cisco-sa-sd-wan-vmanage-4TbynnhZ.

Q: What types of attacks does cisco-sa-sd-wan-vmanage-4TbynnhZ allow?

cisco-sa-sd-wan-vmanage-4TbynnhZ allows unauthenticated remote code execution and escalated privileges for authenticated local attackers.

Q: What versions of Cisco SD-WAN are vulnerable according to cisco-sa-sd-wan-vmanage-4TbynnhZ?

The vulnerable versions include 20.5, 20.4, 20.3, and all versions of 18.4 and earlier, as stated in the advisory.

Published May 5, 2021

Updated

Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-vmanage-4TbynnhZ

Credit

CVE-2021-1275: This vulnerability was found during the resolution(a Cisco TAC support case), CVE-2021-1468(Cisco during internal security testing), CVE-2021-1506: These vulnerabilities were found by N.S.(Cisco during internal security testing), CVE-2021-1505(Cisco during internal security testing), CVE-2021-1508: These vulnerabilities were found by Alex Lumsden(Cisco during internal security testing)

Affected Software

1 affected componentFixes available

cisco SD-WAN vManage Software=20.5, <20.5.1, =20.4, <20.4.1, >=18.4 and earlier, =19.2, =20.1, <=20.3, <20.3.3

20.5.120.4.120.3.3

Event History

May 5, 2021

Advisory Published

via Cisco·04:00 PM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What is the severity of cisco-sa-sd-wan-vmanage-4TbynnhZ?

The severity of cisco-sa-sd-wan-vmanage-4TbynnhZ is critical due to the potential for remote code execution and unauthorized access.

How do I fix cisco-sa-sd-wan-vmanage-4TbynnhZ?