CVE-2023-20179

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied data in element fields. An attacker could...

CVE-2023-20179

Cisco Catalyst SD-WAN Manager (web UI) HTML injection (CVE-2023-20179) is caused by improper validation of user-supplied data in element fields, allowing an authenticated, remote attacker to inject HTML content and modify pages in the web-based management interface. Impact is limited to browser-b...

CVE-2023-20179

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied data in element fields. An attacker could...

CVE-2023-20252

A vulnerability in the Security Assertion Markup Language SAML APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to improper authentication checks for SAML...

CVE-2023-20252

CVE-2023-20252 affects Cisco Catalyst SD-WAN Manager (Cisco vManage) SAML API authentication. Root cause: improper authentication checks in SAML API endpoints allow unauthenticated remote attackers to obtain an authorization token and gain access as an arbitrary user. Impact: high – remote unauth...

CVE-2023-20262

A vulnerability in the SSH service of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to cause a process crash, resulting in a DoS condition for SSH access only. This vulnerability does not prevent the system from continuing to function, and web UI access is not...

CVE-2023-20262

The CVE-2023-20262 issue concerns Cisco Catalyst SD-WAN Manager’s SSH service, where an unauthenticated, remote attacker can crash the SSH process by sending crafted traffic, causing a DoS for SSH while the system continues to function and web UI remains reachable. Root cause is reported as insuf...

CVE-2023-20034

CVE-2023-20034 affects Cisco SD-WAN vManage (Elasticsearch component). The issue arises from a static username/password configured on vManage, enabling an unauthenticated, remote attacker to access the Elasticsearch configuration database and view its content by sending a crafted HTTP request to ...

CVE-2023-20034

Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to access the Elasticsearch configuration database of an affected device with the privileges of the elasticsearch user. These vulnerability is due to the presen...

CVE-2023-20253

Cisco SD-WAN vManage CLI management interface vulnerability (CVE-2023-20253) can allow a locally authenticated, low-privilege attacker to bypass authorization and roll back configurations across vManage controllers and edge devices. Root cause: improper access control in the CLI-management interf...

CVE-2023-20253

A vulnerability in the command line interface cli management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass authorization and allow the attacker to roll back the configuration on vManage controllers and edge router device. This vulnerability is due to...

CVE-2023-20254

A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to access another tenant that is being managed by the same Cisco Catalyst SD-WAN Manager instance. This vulnerability requires the multi-tenant...

CVE-2023-20254

Cisco Catalyst SD-WAN Manager multi-tenant session management flaw allows an authenticated remote attacker to access other tenants on the same instance. Root cause: insufficient user session management when multi-tenant is enabled. Impact: unauthorized tenant data access, potential configuration ...

CVE-2023-20254

A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to access another tenant that is being managed by the same Cisco Catalyst SD-WAN Manager instance. This vulnerability requires the multi-tenant...

Cisco Catalyst SD-WAN Manager Web UI HTML Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied data in element fields. An attacker could...

Cisco Catalyst SD-WAN Manager Vulnerabilities

Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an attacker to access an affected instance or cause a denial of service DoS condition on an affected system. For more information about these vulnerabilities, see the Details "details" section of...

PT-2023-5690 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage affected versions not specified Description: The issue is related to insufficient access controls in the Elasticsearch database used by Cisco SD-WAN vManage software. This could allow an unauthenticated, remote attacker t...

PT-2023-5580 · Cisco · Cisco Catalyst Sd-Wan Manager

Name of the Vulnerable Software and Affected Versions: Cisco Catalyst SD-WAN Manager affected versions not specified Description: A vulnerability in the SSH service could allow an unauthenticated, remote attacker to cause a process crash, resulting in a DoS condition for SSH access only. This...

Cisco SD-WAN vManage 安全漏洞

Cisco SD-WAN vManage is a highly customizable dashboard from Cisco, Inc. that simplifies and automates the deployment, configuration, management, and operation of Cisco SD-WAN. An access control error vulnerability exists in Cisco SD-WAN vManage that stems from improperly enforced access control ...

TP-LINK TL-ER5120G Command Execution Vulnerability

The TP-LINK TL-ER5120G is a multi-WAN port Gigabit commercial router from China P&L TP-LINK. The TP-LINK TL-ER5120G suffers from a command execution vulnerability that stems from a rule name that fails to correctly filter constructed command special characters, commands, and so on. An attacker...