CVE-2021-1233

Cisco SD-WAN Software faces an information-disclosure vulnerability in its CLI, caused by insufficient input validation of requests to the iperf tool. An authenticated, local attacker could craft a request to iperf to read arbitrary files from the device filesystem. Affected product: Cisco SD-WAN...

CVE-2021-1305

Cisco SD-WAN vManageAuthorization Bypass vulnerabilities allow an authenticated, remote attacker to bypass authorization via the web-based management interface and access or view sensitive information. The issue stems from insufficient authorization checks in the vManage web UI, enabling potentia...

CVE-2021-1305 Cisco SD-WAN vManage Authorization Bypass Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system, gain access to sensitive information, and view information that they are not...

CVE-2021-1305 Cisco SD-WAN vManage Authorization Bypass Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system, gain access to sensitive information, and view information that they are not...

CVE-2021-1349 Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. The vulnerability is due to insufficient input validation by the web-based management...

CVE-2021-1349 Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. The vulnerability is due to insufficient input validation by the web-based management...

CVE-2021-1349

CVE-2021-1349 affects Cisco SD-WAN vManage web-based management interface. Root cause: insufficient input validation allowing Cypher query language injection via crafted HTTP requests. Impact: authenticated, remote attacker could obtain sensitive information. Affected product: Cisco SD-WAN vManag...

CVE-2021-1259

Cisco SD-WAN vManage Software is affected by a path traversal vulnerability in its web-based management interface. The issue stems from insufficient validation of HTTP requests, enabling an authenticated remote attacker to craft requests containing directory traversal sequences and write arbitrar...

CVE-2021-1259 Cisco SD-WAN vManage Software Path Traversal Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain write access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP...

CVE-2021-1259 Cisco SD-WAN vManage Software Path Traversal Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain write access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP...

CVE-2021-1260 Cisco SD-WAN Command Injection Vulnerabilities

Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see...

CVE-2021-1260 Cisco SD-WAN Command Injection Vulnerabilities

Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see...

CVE-2021-1260

Cisco CVE-2021-1260 is a set of command-injection vulnerabilities in Cisco SD-WAN products. The advisory notes authenticated attackers could execute commands on affected devices, potentially gaining root privileges. Affected component is the SD-WAN CLI with insufficient input validation. Impact d...

CVE-2021-1261 Cisco SD-WAN Command Injection Vulnerabilities

Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see...

CVE-2021-1261 Cisco SD-WAN Command Injection Vulnerabilities

Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see...

CVE-2021-1261

Cisco SD-WAN Command Injection Vulnerabilities (CVE-2021-1261) affect Cisco SD-WAN (Viptela) devices via input validation issues in the tcpdump utility. An authenticated, local attacker can inject commands, potentially executing with root privileges on the affected device. Several connected sourc...

CVE-2021-1262 Cisco SD-WAN Command Injection Vulnerabilities

Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see...

CVE-2021-1262

CVE-2021-1262 concerns multiple command-injection vulnerabilities in Cisco SD-WAN products. An authenticated attacker could exploit these flaws to run commands on an affected device with root privileges . The CVE is discussed across multiple sources (including Cisco’s advisory), which confirms a ...

CVE-2021-1263

CVE-2021-1263 relates to multiple command‑injection vulnerabilities in Cisco SD‑WAN products. The connected sources confirm that an authenticated attacker could exploit the CLI to execute commands with root privileges on the device, compromising confidentiality, integrity, and potentially availab...

CVE-2021-1263 Cisco SD-WAN Command Injection Vulnerabilities

Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see...