CVE-2023-20034

Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to access the Elasticsearch configuration database of an affected device with the privileges of the elasticsearch user. These vulnerability is due to the presen...

Authorization

A vulnerability in the command line interface cli management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass authorization and allow the attacker to roll back the configuration on vManage controllers and edge router device. This vulnerability is due to...

CVE-2023-20034

CVE-2023-20034 affects Cisco SD-WAN vManage (Elasticsearch component). The issue arises from a static username/password configured on vManage, enabling an unauthenticated, remote attacker to access the Elasticsearch configuration database and view its content by sending a crafted HTTP request to ...

CVE-2023-20034

Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to access the Elasticsearch configuration database of an affected device with the privileges of the elasticsearch user. These vulnerability is due to the presen...

CVE-2023-20253

Cisco SD-WAN vManage CLI management interface vulnerability (CVE-2023-20253) can allow a locally authenticated, low-privilege attacker to bypass authorization and roll back configurations across vManage controllers and edge devices. Root cause: improper access control in the CLI-management interf...

PT-2023-5690 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage affected versions not specified Description: The issue is related to insufficient access controls in the Elasticsearch database used by Cisco SD-WAN vManage software. This could allow an unauthenticated, remote attacker t...

PT-2023-5581 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage affected versions not specified Description: A vulnerability in the command line interface CLI management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass authorization and roll bac...

CVE-2020-26065

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP...

CVE-2020-26064

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entries when parsing certain XML...

Path traversal

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP...

Xxe

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entries when parsing certain XML...

CVE-2020-26064

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entries when parsing certain XML...

CVE-2020-26064

CVE-2020-26064 is a Cisco SD-WAN vManage XXE vulnerability. The issue arises from improper handling of XML External Entity entries when parsing certain XML files, allowing an authenticated, remote attacker to read and write files on the affected system after tricking a user into importing a craft...

CVE-2020-26065

CVE-2020-26065 affects Cisco SD-WAN vManage Web UI. The issue is path traversal caused by insufficient validation of HTTP requests, allowing an authenticated, remote attacker to read arbitrary files. Exploitation requires sending crafted HTTP requests containing directory traversal sequences. Cis...

CVE-2020-26065

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP...

CVE-2020-26065

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP...

CVE-2023-20214

A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to gain read permissions or limited write permissions to the configuration of an affected Cisco SD-WAN vManage instance. This vulnerability is...

Input validation

A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to gain read permissions or limited write permissions to the configuration of an affected Cisco SD-WAN vManage instance. This vulnerability is...

CVE-2023-20214

Cisco SD-WAN vManage REST API authentication validation vulnerability (CVE-2023-20214) allows unauthenticated remote attackers to read or partially modify configuration due to insufficient REST API request validation. Affected product: Cisco SD-WAN vManage (REST API surface only; web UI/CLI unaff...

CVE-2023-20214

A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to gain read permissions or limited write permissions to the configuration of an affected Cisco SD-WAN vManage instance. This vulnerability is...