cisco-sa-sdscred-HfWWfqBj: Cisco SD-WAN Solution Software Static Credentials Vulnerability
First published: Wed Jul 15 2020(Updated: )
A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, local attacker to access an affected device by using an account that has a default, static password. This account has root privileges. The vulnerability exists because the affected software has a user account with a default, static password. An attacker could exploit this vulnerability by remotely connecting to an affected system by using this account. A successful exploit could allow the attacker to log in by using this account with root privileges. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdscred-HfWWfqBj
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco SD-WAN vEdge, vBond, and vSmart Software Releases | >=.3<18<=18.3<18.3.6 | 18.3.6 |
| Cisco SD-WAN vManage | =19.2<19.2.2>=.3<18=18.3<=18.4<18.4.5 | 19.2.2 18.4.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-sdscred-HfWWfqBj?
The severity of cisco-sa-sdscred-HfWWfqBj is classified as high due to the potential for unauthorized access to devices.
How do I fix cisco-sa-sdscred-HfWWfqBj?
To fix cisco-sa-sdscred-HfWWfqBj, update the affected Cisco SD-WAN software to the recommended versions provided in the advisory.
What are the affected products in cisco-sa-sdscred-HfWWfqBj?
The affected products include Cisco SD-WAN vBond, vEdge, vSmart Software and SD-WAN vManage Software versions specified in the advisory.
Who can exploit cisco-sa-sdscred-HfWWfqBj?
An unauthenticated, local attacker can exploit cisco-sa-sdscred-HfWWfqBj by using a default, static password to access the affected device.
What type of access can be gained through cisco-sa-sdscred-HfWWfqBj?
Exploitation of cisco-sa-sdscred-HfWWfqBj can provide root-level access to the affected Cisco SD-WAN devices.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/severity
- agent/title
- agent/weakness
- agent/references
- agent/description
- agent/event
- agent/softwarecombine
- agent/source
- agent/tags
- collector/cisco-advisory
- source/Cisco
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco sd-wan vedge, vbond, and vsmart software releases
- version/cisco sd-wan vedge, vbond, and vsmart software releases/.3
- version/cisco sd-wan vedge, vbond, and vsmart software releases/18.3
- canonical/cisco sd-wan vmanage
- version/cisco sd-wan vmanage/19.2
- version/cisco sd-wan vmanage/.3
- version/cisco sd-wan vmanage/18.3
- version/cisco sd-wan vmanage/18.4