Cisco SD-WAN Solution vManage SQLi (cisco-sa-20200318-vmanage-cypher-inject)

The version of Cisco SD-WAN Solution vManage installed on the remote host is affected by a vulnerability as referenced in the cisco-sa-20200318-vmanage-cypher-inject advisory. - A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker t...

Cisco SD-WAN Solution Privilege Escalation (cisco-sa-20190619-sdwan-privilescal)

According to its self-reported version, Cisco SD-WAN Solution vManage software is affected by a privilege escalation vulnerability in the web-based UI due to a failure to properly authorize certain user actions in the device configuration. An authenticated, remote attacker can exploit this to gai...

Cisco SD-WAN vManage Software DoS (cisco-sa-emvman-3y6LuTcZ)

According to its self-reported version, Cisco SD-WAN vManage is affected by a denial of service vulnerability in the web-based management interface due to inefficient memory management. An authenticated, remote attacker can exploit this, by sending a large number of crafted HTTP requests to the...

Cisco SD-WAN Solution Packet Filtering Bypass (cisco-sa-20190807-sd-wan-bypass)

According to its self-reported version, Cisco SD-WAN Solution is affected by a vulnerability in the packet filtering features due to improper traffic filtering conditions on an affected device. An unauthenticated, remote attacker can exploit this, by crafting a malicious TCP packet with specific...

Cisco SD-WAN vManage Software SQLi (cisco-sa-sivm-M8wugR9O)

According to its self-reported version, Cisco SD-WAN vManage is affected by an SQL injection SQLi vulnerability in the web-based management interface due to not properly validating user-supplied input. An authenticated, remote attacker can exploit this, by sending crafted input that includes SQL...

Cisco SD-WAN vEdge Routers DoS (cisco-sa-vedgfpdos-PkqQrnwV)

According to its self-reported version, Cisco SD-WAN vEdge routers are affected by a denial of service DoS vulnerability in the deep packet inspection DPI engine due to insufficient handling of malformed packets. An unauthenticated, adjacent attacker can exploit this to cause a DoS condition...

Cisco SD-WAN vManage Software Path Traversal (cisco-sa-vmandowndir-CVGvdKM3)

The version of Cisco SD-WAN vManage Software installed on the remote host is affected by a vulnerability as referenced in the cisco-sa-vmandowndir-CVGvdKM3 advisory. - A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote...

Cisco SD-WAN Solution Local Privilege Escalation (cisco-sa-20200122-sdwan-priv-esc)

According to its self-reported version, Cisco SD-WAN vManage is affected by a vulnerability due to insufficient input validation. An authenticated, local attacker can exploit this, by sending a crafted file, in order to elevate privileges to root on the underlying operating system. Please see the...

Cisco SD-WAN Solution Command Injection (cisco-sa-sdwclici-cvrQpH9v)

According to its self-reported version, Cisco SD-WAN Solution is affected by a command injection vulnerability due to insufficient input validation. An authenticated, local attacker can exploit this, by authenticating to the device and submitting crafted input to the CLI utility, in order to inje...

Cisco SD-WAN vManage Command Injection (cisco-sa-20200122-sdwan-cmd-inject)

The version of Cisco SD-WAN vManage installed on the remote host is prior to 18.3.0. It is, therefore, affected by a vulnerability as referenced in the cisco-sa-20200122-sdwan-cmd-inject advisory. - A vulnerability in the WebUI of the Cisco SD-WAN Solution could allow an authenticated, remote...

Cisco SD-WAN Solution vManage Cross-Site Request Forgery (cisco-sa-20191120-vman-csrf)

The version of Cisco SD-WAN Solution vManage installed on the remote host is affected by a vulnerability as referenced in the cisco-sa-20191120-vman-csrf advisory, as follows: - A vulnerability in the vManage web-based UI web UI of the Cisco SD-WAN Solution could allow an unauthenticated, remote...

Cisco SD-WAN Solution SQLI (cisco-sa-20200122-sdwan-sqlinj)

According to its self-reported version, Cisco SD-WAN vManage is affected by an SQL injection SQLI vulnerability in the web interface due to insufficient validation of user-supplied input. An authenticated, remote attacker can exploit this, by sending crafted input that includes SQL statements to ...

Cisco SD-WAN vManage Software XXE (cisco-sa-vmanxml-Aj4GFEKd)

The version of Cisco SD-WAN vManage Software installed on the remote host is 19.2.2 or earlier. It is, therefore, affected by a vulnerability as referenced in the cisco-sa-vmanxml-Aj4GFEKd advisory. - A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated,...

Cisco SD-WAN Solution vManage Stored XSS (cisco-sa-20200318-vmanage-xss)

The version of Cisco SD-WAN Solution vManage installed on the remote host is affected by a vulnerability as referenced in the cisco-sa-20200318-vmanage-xss advisory. - A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to conduct a...

Cisco SD-WAN vManage Authorization Bypass (cisco-sa-vman-authorization-b-GUEpSLK)

The version of Cisco SD-WAN vManage installed on the remote host is affected by a vulnerability as referenced in the cisco-sa-vman-authorization-b-GUEpSLK advisory due to insufficient input validation for certain commands. An authenticated, remote attacker can exploit this, by sending crafted...

Cisco SD-WAN vDaemon Buffer Overflow Vulnerability

A vulnerability in the vDaemon service of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to cause a buffer overflow on an affected system, resulting in a denial of service DoS condition. The vulnerability is due to incomplete bounds checks for data that is provided to...

Cisco SD-WAN vManage Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying filesystem of an affected system. This vulnerability is due to insufficient access control for sensitive information that ...

Cisco SD-WAN vManage Authorization Bypass Vulnerability

A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization checking and gain restricted access to the configuration information of an affected system. This vulnerability exists because the affected software has insufficient input...

Cisco SD-WAN vManage SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to improper input validation of SQL queries to an affected system. An attacker cou...

Cisco SD-WAN vManage Directory Traversal Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a directory traversal attack and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP...