CVE-2020-4003

CVE-2020-4003 affects VMware SD-WAN Orchestrator, with versions 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1; it is a SQL injection flaw that allows an authenticated SD-WAN Orchestrator user to inject code into SQL queries and potentially disclose information. The CVE i...

CVE-2020-4003

VMware SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 was found to be vulnerable to SQL-injection attacks allowing for potential information disclosure. An authenticated SD-WAN Orchestrator user may inject code into SQL queries which may lead to...

CVE-2020-4002

The CVE-2020-4002 entry affects VMware SD-WAN Orchestrator, with versions 3.3.2 before 3.3.2 P3, 3.4.x before 3.4.4, and 4.0.x before 4.0.1, where system parameters are handled insecurely. The root cause is insecure handling of system parameters that may allow an authenticated, high-privilege SD-...

CVE-2020-4002

The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 handles system parameters in an insecure way. An authenticated SD-WAN Orchestrator user with high privileges may be able to execute arbitrary code on the underlying operating system...

CVE-2020-4001

The CVE-2020-4001 issue affects VMware SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x, due to default credentials that may enable a Pass-the-Hash attack. The vulnerability is documented in VMware’s advisory VMSA-2020-0025 and is corroborated by related Red Hat/NVD entries. Impact is described as a h...

CVE-2020-4001

The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts which may lead to to a Pass-the-Hash attack...

Cisco SD-WAN vManage Software XSS (cisco-sa-vmanxss1-XhJCymBt)

According to its self-reported version, Cisco SD-WAN vManage is affected by a cross-site scripting XSS vulnerability in the web-based management interface due to not properly validating user-supplied input. An authenticated, remote attacker can exploit this, by convincing a user to click a...

Cisco SD-WAN vManage Software XXE (cisco-sa-vmanx3-vrZbOqqD)

According to its self-reported version, Cisco SD-WAN vManage is affected by an XML external entity XXE vulnerability due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. An authenticated, remote attacker can exploit this, via specially crafted XML...

Cisco SD-WAN Software Privilege Escalation (cisco-sa-vepeshlg-tJghOQcA)

According to its self-reported version, Cisco SD-WAN Software is affected by a privilege escalation vulnerability due to insufficient security controls on the CLI. An authenticated, local attacker can exploit this, by using an affected CLI utility, to gain root privileges. Please see the included...

Cisco SD-WAN vManage Software XSS (cisco-sa-vmanxss2-ugJyqxWF)

According to its self-reported version, Cisco SD-WAN vManage is affected by a cross-site scripting XSS vulnerability in the web-based management interface due to not properly validating user-supplied input. An authenticated, remote attacker can exploit this, by convincing a user to click a...

Cisco IOS XE SD-WAN Software Packet Filtering Bypass (cisco-sa-cedge-filt-bypass-Y6wZMqm4)

According to its self-reported version, Cisco SD-WAN Solution is affected by a packet filtering bypass vulnerability. The vulnerability is due to improper traffic filtering conditions on an affected device. An unauthenticated, remote attacker could exploit this vulnerability by crafting a malicio...

Vmware VMWare SD-WAN Orchestrator Path Traversal Vulnerability

Vmware VMWare SD-WAN Orchestrator is a software from Vmware that orchestrates network data flows in a software-defined network architecture. The software provides Web pages to visualize and manage users, gateways, and authentication. A path traversal vulnerability exists in VMware SD-WAN...

VMware Releases Security Updates for VMware SD-WAN Orchestrator

VMware has released security updates to address multiple vulnerabilities in VMware SD-WAN Orchestrator. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to...

VMWare SD-WAN Orchestrator Trust Management Issue Vulnerability

Vmware VMWare SD-WAN Orchestrator is a software from Vmware that orchestrates network data flows in a software-defined network architecture. The software provides Web pages to visualize and manage users, gateways, and authentication. A security vulnerability exists in VMware SD-WAN Orchestrator...

VMWare SD-WAN Orchestrator SQL Injection Vulnerability

Vmware VMWare SD-WAN Orchestrator is a software from Vmware that orchestrates network data flows in a software-defined network architecture. The software provides Web pages to visualize and manage users, gateways, and authentication. An SQL injection vulnerability exists in VMware SD-WAN...

VMware SD-WAN Orchestrator updates address multiple security vulnerabilities (CVE-2020-3984, CVE-2020-3985, CVE-2020-4000, CVE-2020-4001, CVE-2020-4002 ,CVE-2020-4003)

3a. SQL injection vulnerability due to improper input validation CVE-2020-3984 The SD-WAN Orchestrator does not apply correct input validation which allows for SQL-injection. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of...

The vulnerability in the web-based management interface of Cisco SD-WAN allows a attacker to execute cross-site attacks.

The vulnerability in the Cisco SD-WAN programmatically-defined network management web interface is related to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

Cisco SD-WAN Software Privilege Escalation (cisco-sa-vepestd-8C3J9Vc)

According to its self-reported version, Cisco SD-WAN is affected by a privilege escalation vulnerability exists due to insufficient input validation. An authenticated, local attacker can exploit this by sending crafted options to a specific command, to gain root access to the system. TRUSTED...

The vulnerability in the web-based management interface of Cisco SD-WAN allows a attacker to execute cross-site attacks.

The vulnerability in the Cisco SD-WAN programmatically-defined network management web interface is related to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

Citrix SD-WAN Center Remote Code Execution (CVE-2020-8271)

A remote code execution vulnerability exists in Citrix SD-WAN. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...