The vulnerability of the cluster software-defined networking control interface of Cisco SD-WAN allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Cisco SD-WAN programmatically-defined network management interface is related to privilege management errors. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the programmatically defined Cisco SD-WAN API component allows attackers to execute cross-site scripting (XSS) attacks.

The vulnerability of the programmable Cisco SD-WAN API component is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting XSS attacks remotely...

The vulnerability of the cluster-mode programmable Cisco SD-WAN architecture allows a intruder to gain unauthorized access to services within the vulnerable system.

The vulnerability of the programmable network-based Cisco SD-WAN architecture in cluster mode is related to lack of access control. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to services within the vulnerable system...

aloha-sd (>=1.0.0 <=1.0.7) potentially affected by CVE-2021-23386 via dns-packet (=1.1.1)

dns-packet NPM version =1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dns-packet and may be impacted: - aloha-sd =1.0.0, =1.0.7 Source cves: CVE-2021-23386 Source advisory: SNYK:JS-DNSPACKET-1293563...

The vulnerability in the vManage web interface of the software-defined Cisco SD-WAN network allows a malicious individual to gain unauthorized access to protected information.

The vulnerability in the vManage web interface of the Cisco SD-WAN software-defined network is related to authentication process errors. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by sending specially crafted HTTP requests...

Cisco SD-WAN vManage Software Information Disclosure (cisco-sa-sdwan-vmaninfdis3-OvdR6uu8)

According to its self-reported version, Cisco SD-WAN vManage Software is affected by an information disclosure vulnerability in the cluster management interface. An unauthenticated, remote attacker can exploit this, by sending a crafted request, in order to disclose information. Note that Nessus...

Cisco SD-WAN Software Arbitrary File Corruption (cisco-sa-sdwan-arbfile-7Qhd9mCn)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by an arbitrary file corruption vulnerability. A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system of an affect...

Cisco SD-WAN Software Privilege Escalation (cisco-sa-sdwan-privesc-QVszVUPy)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a privilege escalation vulnerability. A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Administrator privileges on...

Cisco SD-WAN vManage Software Vulnerabilities (cisco-sa-sd-wan-vmanage-4TbynnhZ)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by multiple vulnerabilities that allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or...

Cisco SD-WAN vManage Software Authentication Bypass (cisco-sa-sdw-auth-bypass-65aYqcS2)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability in the web-based messaging service interface. An unauthenticated, adjacent attacker can exploit this, by sending crafted HTTP requests, to gain unauthenticated read and write access to the affecte...

Cisco SD-WAN vManage HTTP Authentication User Enumeration (cisco-sa-vmanage-enumeration-64eNnDKy)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by an information disclosure vulnerability due to improper handling of HTTP headers. An unauthenticated, remote attacker can exploit this, via HTTP, to determine which accounts are valid user accounts. Please see th...

Cisco SD-WAN Software Input Validation Error Vulnerability

Cisco SD-WAN vManage is a software from Cisco that provides software-defined networking capabilities. The software provides a way to virtualize the network. A security vulnerability exists in Cisco SD-WAN Software that can be exploited by a local attacker to overwrite arbitrary files in the...

Cisco SD-WAN vManage Information Disclosure (cisco-sa-sd-wan-vmanage-9VZO4gfU)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by an information disclosure vulnerability due to improper access controls on API endpoints when running in multi-tenant mode. An unauthenticated, adjacent attacker can exploit this, by sending a request to an...

Cisco SD-WAN vManage API Stored XSS (cisco-sa-vmanage-xss-eN75jxtW)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a stored cross-site scripting vulnerability due to the API not properly validating user-supplied input. An authenticated, remote attacker can exploit this, by sending malicious input to the API, to execute...

Critical Cisco SD-WAN, HyperFlex Bugs Menace Networks

Cisco has addressed two critical security vulnerabilities in the SD-WAN vManage Software, one of which could allow an unauthenticated attacker to carry out remote code execution RCE on corporate networks or steal information. The networking giant also disclosed a denial-of-service issue in vManag...

CVE-2021-1535

A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. To be affected by this vulnerability, the Cisco SD-WAN vManage Software must be in cluster mode. This...

CVE-2021-1468

Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application. For...

CVE-2021-1511

Multiple vulnerabilities in Cisco SD-WAN vEdge Software could allow an attacker to execute arbitrary code as the root user or cause a denial of service DoS condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory...

CVE-2021-1486

A vulnerability in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to enumerate user accounts. This vulnerability is due to the improper handling of HTTP headers. An attacker could exploit this vulnerability by sending authenticated requests to an affected system. A...

CVE-2021-1505

Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application. For...