cisco-sa-vepescm-BjgQm4vJ: Cisco SD-WAN Software Privilege Escalation Vulnerability
A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to a utility that is running on an affected system. A successful exploit could allow the attacker to gain root privileges. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vepescm-BjgQm4vJ
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-vepescm-BjgQm4vJ?
The vulnerability cisco-sa-vepescm-BjgQm4vJ has a high severity level due to its ability to allow privilege escalation.
How do I fix cisco-sa-vepescm-BjgQm4vJ?
To fix cisco-sa-vepescm-BjgQm4vJ, upgrade to the latest fixed versions of Cisco SD-WAN Software as recommended in the advisory.
Who is affected by cisco-sa-vepescm-BjgQm4vJ?
Users of Cisco SD-WAN Software versions 19.3, 20.1, and 20.3 are affected by cisco-sa-vepescm-BjgQm4vJ.
What causes the vulnerability cisco-sa-vepescm-BjgQm4vJ?
The vulnerability cisco-sa-vepescm-BjgQm4vJ is caused by insufficient input validation in the affected Cisco SD-WAN Software.
Can cisco-sa-vepescm-BjgQm4vJ be exploited remotely?
No, cisco-sa-vepescm-BjgQm4vJ requires an authenticated local attacker to exploit the vulnerability.