Cisco warns customers about critical security vulnerabilities affecting SD-WAN, DNA, and the Smart Software Manager Satellite.

Security Vulnerabilities:

Earlier this week, Cisco released a security advisory on multiple vulnerabilities including critical and high severity scores.

“Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device,” Cisco notes. 

However, “A successful exploit could allow the attacker to gain root-level access to the affected system,” 

Follow Us on: Twitter, Instagram, Facebook to get latest security news!

Vulnerable Products:

These vulnerabilities affect the following Cisco products if they are running a vulnerable release of Cisco SD-WAN Software:

• vBond Orchestrator Software
• vEdge Cloud Routers
• vEdge Routers
• vManage Software
• vSmart Controller Software

Cisco SD-WAN vManage — CVE-2021-1299 & CVE-2021-1298

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected system.

However,

• CVE-2021-1299 — vulnerability is due to improper input validation of user-supplied input to the device template configuration.
• CVE-2021-1298 — vulnerability is due to improper input validation of user-supplied input to the SSO configuration.

Also, An attacker could exploit this vulnerability by submitting crafted input to the device template configuration.

The vAnalytics feature of Cisco SD-WAN vManage Software must be enabled for this vulnerability to be exploited.

Cisco SD-WAN CLI Command Injection Vulnerability

Below are the security vulnerability CVE’s for Cisco SD-WAN CLI Command Injection Vulnerability:

• CVE-2021-1260
• CVE-2021-1261
• CVE-2021-1262
• CVE-2021-1263

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow the attacker to obtain root privileges and read, write, and delete files of the underlying file system of an affected device.

Also, This vulnerability is due to insufficient validation of user-supplied input on the CLI.

However, An attacker could exploit this vulnerability by authenticating with read-only privileges via the CLI of an affected device and submitting crafted input to the affected commands.

Security Fix Release:

In short, Cisco advised its customers to upgrade to an appropriate fixed software release: