cisco-sa-sdwpresc-ySJGvE9: Cisco SD-WAN Solution Privilege Escalation Vulnerability
First published: Wed Mar 18 2020(Updated: )
A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain root-level privileges. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwpresc-ySJGvE9
Credit: Orange Group.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco SD-WAN firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-sdwpresc-ySJGvE9?
The severity of cisco-sa-sdwpresc-ySJGvE9 is considered high due to the potential for an attacker to elevate privileges to root.
How do I fix cisco-sa-sdwpresc-ySJGvE9?
To fix cisco-sa-sdwpresc-ySJGvE9, apply the latest security patches and updates provided by Cisco for the SD-WAN Solution software.
Who is affected by cisco-sa-sdwpresc-ySJGvE9?
Cisco SD-WAN Solution users running vulnerable software versions are affected by cisco-sa-sdwpresc-ySJGvE9.
What are the potential impacts of cisco-sa-sdwpresc-ySJGvE9?
The potential impacts of cisco-sa-sdwpresc-ySJGvE9 include unauthorized access and control over the underlying operating system.
How can an attacker exploit cisco-sa-sdwpresc-ySJGvE9?
An attacker can exploit cisco-sa-sdwpresc-ySJGvE9 by sending crafted input that bypasses insufficient input validation.
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- collector/cisco-advisory
- source/Cisco
- agent/author
- agent/title
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco sd-wan firmware