Cisco Catalyst SD-WAN Manager Privilege Escalation (cisco-sa-sdwan-priviesc-WCk7bmmt)

#TRUSTED 16854dd162ab47bec8a80cacfffef0009c2cecdd4a6e2531b8bf3a4631ea00d4a319b08402bf95c4669ccbb8ba86b451dadaa2782067a0ea7abf86a09e80cde67cf53581754dfc1e65d965ef6be1b4fefa6db1f92d8b9de5355692cd713268bcc98f3c06be90fbc662e69bd657a4fe339f0f3b4e1548b955e3ecc3690dac9afa1d332962d614bf0c3ebe05809539eedb8408d4b46bdd144c23d2140b46b58bb6e02eebd581665de791cb7a51e31d78f59ed2dbba64b3a82705904247bda2f1a5c17bbb4fb5e69b19af4ae9eb7b712ee25a9f5ab5874a99e524d61b778cc911dff40db13525e3050d426aaa21c0bae1a2ebc6d2a23e4b3df1ec4ff335954e026c089b2cf606efefa003f6a3aee98829d7a64d4605ca51fec5f69274df77742bfca19cce178ba7fd6e3406a363f5304a2f349a04b28592345f548202c8156c0e748414e7a7d3114d97b7c86a5d10c1ab136d486bbe833cef5bd4acd75ea1121d42aa6a0a16baea256f8316b901f1fc8de1ca6f39b6d20fe8e485be935729d0feea59d090772ee65ccb20c13e49e75c85527e6c4b372283e2505152f190f140f635c103e32c7c32ef899c0809150577cee442704e70b0f2f1f80daf9f1a36751506283e0a178e0a781733f8c19382b1b20f729675eb8860575302997911354786fb76f14997e537488bbe350ea91c322454fdcb80bccee4230c637fb49774525ea2
#TRUST-RSA-SHA256 64ab60bb49cad1a77c89f4523cb2c3c97990a23b66a535fe5838bb477fd2ce6d6811ddd66aa756f02ea8ffb76723f5274fbe7ea1ae84c996ca72a5b02f1c23d4a82c51ffd29552abd8340779d8a41b78911ae6299ffe4f1bba05d888d46ffd1d52b5f71eb8e74d62a18335eead4e65e36c36b94a150083a351283465b3a3764bd0723856411b3b78e41f9bb3ec8d24a986e4784156211d64d65718b30c8e23d72d0d2eea43f47180eb7204fd1b3b7cfae53d137eef17cac9e0f7b6260fb11feb567f9b745b31192340fb5bc260ebb6dba61b3c800ffcae88247a8d24f1efe1d8104af43c9f9659acb695d7f9f11e57528a2a9a6e4cffbf74dbebe5906f93c411a1081ccb315254458ab86aabe360b1333668f7ec8d344df5287f4cb043b59a0a0f080834ab3f8d590a161720d9a87438a90db29989393480e2fc4327281f5dfc6bde059734a002a39ace51f5a67d44cb1d9663828d081b5f9aef8d8f6fce1f11e5b2c53a47676eea505341b02f7845f154d181c4421471cb3fd3e2e0a7b2defe2aaed09c29dd07d0d5e02bb21eeeef8e3745d1f15571668f12c0e2a900ebcbd5c894e2d92baad2a9d07f6bafedeb40d01604c9a2cb8a7fb043d7d4e66039395a28f4e1741fed1c4c3f74eebad9b471d176aa9e76c03fb1dda95b41c328f92a9fe094fc9c1b25933d7c1b02f2f8b8d63f97acaa7d5e6a24e230e4108d41f0bb63
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(235483);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-20122");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk92200");
  script_xref(name:"CISCO-SA", value:"cisco-sa-sdwan-priviesc-WCk7bmmt");
  script_xref(name:"IAVA", value:"2025-A-0316-S");

  script_name(english:"Cisco Catalyst SD-WAN Manager Privilege Escalation (cisco-sa-sdwan-priviesc-WCk7bmmt)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability.

  - A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an
    authenticated, local attacker to gain privileges of the root user on the underlying operating system. This
    vulnerability is due to insufficient input validation. An authenticated attacker with read-only privileges
    on the SD-WAN Manager system could exploit this vulnerability by sending a crafted request to the CLI of
    the SD-WAN Manager. A successful exploit could allow the attacker to gain root privileges on the
    underlying operating system. (CVE-2025-20122)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-priviesc-WCk7bmmt
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?87ec9513");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk92200");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk92200");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20122");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(300);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:sd-wan_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_vedge_detect.nbin");
  script_require_keys("Cisco/Viptela/Version");

  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco Viptela');

if ('vmanage' >!< tolower(product_info['model']))
  audit(AUDIT_HOST_NOT, 'an affected model');

var vuln_ranges = [
  { 'min_ver' : '0.0', 'fix_ver' : '20.9.7' },
  { 'min_ver' : '20.10', 'fix_ver' : '20.12.5' },
  { 'min_ver' : '20.13', 'fix_ver' : '20.15.2' },
  { 'min_ver' : '20.16', 'fix_ver' : '20.16.1' }
];

 
var reporting = make_array(
  'port'     , 0,
  'severity' , SECURITY_WARNING,
  'bug_id'   , 'CSCwk92200',
  'version'  , product_info['version'],
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  vuln_ranges:vuln_ranges,
  reporting:reporting
);