Critical Security Vulnerabilities In Cisco SD-WAN — Update Now

Home/Security Update, Software Issues/Critical Security Vulnerabilities In Cisco SD-WAN — Update Now

Critical Security Vulnerabilities In Cisco SD-WAN — Update Now

Cisco warns customers about critical security vulnerabilities affecting SD-WAN, DNA, and the Smart Software Manager Satellite.

Security Vulnerabilities:

Earlier this week, Cisco released a security advisory on multiple vulnerabilities including critical and high severity scores.

“Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device,” Cisco notes. 

However, “A successful exploit could allow the attacker to gain root-level access to the affected system,” 

Follow Us on: Twitter, InstagramFacebook to get latest security news!

Vulnerable Products:

These vulnerabilities affect the following Cisco products if they are running a vulnerable release of Cisco SD-WAN Software:

  • vBond Orchestrator Software
  • vEdge Cloud Routers
  • vEdge Routers
  • vManage Software
  • vSmart Controller Software

Cisco SD-WAN vManageCVE-2021-1299 & CVE-2021-1298

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected system.

However,

  • CVE-2021-1299 — vulnerability is due to improper input validation of user-supplied input to the device template configuration.
  • CVE-2021-1298 — vulnerability is due to improper input validation of user-supplied input to the SSO configuration.

Also, An attacker could exploit this vulnerability by submitting crafted input to the device template configuration.

The vAnalytics feature of Cisco SD-WAN vManage Software must be enabled for this vulnerability to be exploited.

CVE ID:CVE-2021-1299
CVSS Base Score:9.9
CVSS Vector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE ID:CVE-2021-1298
CVSS Base Score:5.3
CVSS VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Cisco SD-WAN CLI Command Injection Vulnerability

Below are the security vulnerability CVE’s for Cisco SD-WAN CLI Command Injection Vulnerability:

  • CVE-2021-1260
  • CVE-2021-1261
  • CVE-2021-1262
  • CVE-2021-1263

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow the attacker to obtain root privileges and read, write, and delete files of the underlying file system of an affected device.

Also, This vulnerability is due to insufficient validation of user-supplied input on the CLI.

However, An attacker could exploit this vulnerability by authenticating with read-only privileges via the CLI of an affected device and submitting crafted input to the affected commands.

Security Fix Release:

In short, Cisco advised its customers to upgrade to an appropriate fixed software release:

Cisco SD-WAN ReleaseFirst Fixed Release for These VulnerabilitiesFirst Fixed Release for All Vulnerabilities Described in the Collection of Advisories
Earlier than 18.3Migrate to a fixed release.Migrate to a fixed release.
18.3Migrate to a fixed release.Migrate to a fixed release.
18.4Migrate to a fixed release.Migrate to a fixed release.
19.2Migrate to a fixed release.Migrate to a fixed release.
19.3Migrate to a fixed release.Migrate to a fixed release.
20.120.1.2Migrate to a fixed release.
20.320.3.220.3.2
20.420.4.120.4.1
Source – Cisco SD-WAN Command Injection Vulnerabilities

By | 2021-01-24T15:13:18+05:30 January 24th, 2021|Security Update, Software Issues|

About the Author:

FirstHackersNews- Identifies Security

Leave A Comment

Subscribe to our newsletter to receive security tips everday!