CVE-2020-27129 Cisco SD-WAN vManage Software Command Injection Vulnerability

A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and potentially gain elevated privileges. The vulnerability is due to improper validation of commands to the remote management CLI of the...

CVE-2020-27129 Cisco SD-WAN vManage Software Command Injection Vulnerability

A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and potentially gain elevated privileges. The vulnerability is due to improper validation of commands to the remote management CLI of the...

CVE-2020-27129

CVE-2020-27129 affects Cisco SD-WAN vManage’s remote management CLI. The root cause is improper validation of commands, allowing an authenticated, local attacker to inject arbitrary commands and potentially elevate privileges. Public records from the Cisco advisory confirm this vulnerability and ...

CVE-2020-27128 Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability

A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by...

CVE-2020-27128

The Cisco SD-WAN vManage Software Arbitrary File Creation vulnerability (CVE-2020-27128) affects the application data endpoints and stems from improper validation of API requests, enabling an authenticated, remote attacker to perform directory traversal and write arbitrary files to an attacker-co...

CVE-2020-27128 Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability

A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by...

Cisco SD-WAN vManage XSS (cisco-sa-vmanxsshi-9KHEqRpM)

According to its self-reported version, Cisco SD-WAN vManage is affected by a cross-site scripting XSS vulnerability in the web-based management interface due to not properly validating user-supplied input. An authenticated, remote attacker can exploit this, by convincing a user to click a...

Cisco SD-WAN vManage Software Command Injection (cisco-sa-vmanage-privilege-zPmMf73k)

According to its self-reported version, Cisco SD-WAN vManage is affected by a command injection vulnerability in its remote management feature due to insufficient validation of commands to the remote management CLI. An authenticated, local attacker can exploit this, by sending specially crafted...

Cisco SD-WAN vManage Software Privilege Escalation (cisco-sa-vmanage-escalation-Jhqs5Skf)

According to its self-reported version, Cisco SD-WAN vManage is affected by a privilege escalation vulnerability due to improper validation of path input to the system file transfer functions. An authenticated, local attacker can exploit this to overwrite arbitrary files, allowing the attacker to...

Cisco SD-WAN vManage Software Authorization Bypass (cisco-sa-uabvman-SYGzt8Bv)

According to its self-reported version, Cisco SD-WAN vManage is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

Cisco Zero-Day in AnyConnect Secure Mobility Client Remains Unpatched

Cisco has disclosed a zero-day vulnerability – for which there is not yet a patch – in the Windows, macOS and Linux versions of its AnyConnect Secure Mobility Client Software. While Cisco said it is not aware of any exploits in the wild for the vulnerability, it said Proof-of-Concept PoC exploit...

Cisco SD-WAN vManage XML External Entity Injection Vulnerability (CNVD-2020-66211)

Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. An XML external entity injection vulnerability exists in the web UI of Cisco SD-WAN vManage 20.1.12 and earlier. The vulnerability stems from improper handling of XML External Entity XXE...

Cisco SD-WAN vManage XML External Entity Injection Vulnerability

Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. An XML external entity injection vulnerability exists in the web UI of Cisco SD-WAN vManage 20.1.12 and earlier. The vulnerability stems from improper handling of XML External Entity XXE...

Cisco SD-WAN vManage Directory Traversal Vulnerability

Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. A directory traversal vulnerability exists in the application data endpoint of Cisco SD-WAN vManage. The vulnerability stems from improper validation of directory traversal character...

Cisco SD-WAN vEdge Access Control Error Vulnerability

Cisco SD-WAN vEdge is a router from Cisco. The device provides basic WAN, security, and multi-cloud capabilities for Cisco SD-WAN solutions. An Access Control Error vulnerability exists in Cisco SD-WAN. The vulnerability arises from a network system or product that does not properly restrict acce...

Cisco SD-WAN Software Privilege Escalation Vulnerability

A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient security controls on the CLI. An attacker could exploit this vulnerability by using an affected CLI...

Cisco SD-WAN vManage Software XML External Entity Vulnerability

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entries when parsing certain XML...

Cisco SD-WAN vManage Software Command Injection Vulnerability

A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and potentially gain elevated privileges. The vulnerability is due to improper validation of commands to the remote management CLI of the...

Cisco SD-WAN vManage Software Path Traversal Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP...

Cisco SD-WAN vManage Software Privilege Escalation Vulnerability

A vulnerability in system file transfer functions of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to gain escalated privileges on the underlying operating system. The vulnerability is due to improper validation of path input to the system file transfer functions. An...