CVE-2019-1625

CVE-2019-1625 affects Cisco SD-WAN Solution CLI. An authenticated, local attacker can bypass authorization and escalate privileges to root due to insufficient enforcement in the CLI. Exploitation would allow privileged configuration changes on affected devices. Mitigation observed in connected so...

CVE-2019-1626

CVE-2019-1626 is a privilege-escalation flaw in Cisco SD-WAN vManage Web UI. An authenticated, remote attacker could exploit a failure to properly authorize certain user actions in the device configuration by sending crafted HTTP requests via the vManage Web UI, gaining elevated privileges and al...

CVE-2020-3115

CVE-2020-3115 : A vulnerability in the CLI of Cisco SD-WAN Solution vManage allows an authenticated, local attacker to gain root-level privileges due to insufficient input validation. Exploitation requires sending a crafted file to the affected system; local access is required and the attack is l...

CVE-2019-12629

The CVE-2019-12629 issue pertains to Cisco SD-WAN vManage WebUI. Affected component: WebUI of Cisco SD-WAN Solution; root cause: insufficient input validation of data parameters in login-related fields. Exploitation: an authenticated remote attacker can configure a malicious username on the login...

CVE-2021-1300

CVE-2021-1300 corresponds to Cisco SD-WAN Buffer Overflow vulnerabilities. Connected sources indicate multiple buffer-overflow flaws in Cisco SD-WAN products that could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges by crafting IP traffic or abusing IP ha...

CVE-2019-12619

Cisco SD-WAN Solution vManage web interface is affected by an SQL injection due to insufficient validation of user-supplied input. An authenticated, remote attacker can craft inputs containing SQL statements to execute arbitrary queries, potentially modifying entries in database tables and compro...

CVE-2021-1233

Cisco SD-WAN Software faces an information-disclosure vulnerability in its CLI, caused by insufficient input validation of requests to the iperf tool. An authenticated, local attacker could craft a request to iperf to read arbitrary files from the device filesystem. Affected product: Cisco SD-WAN...

CVE-2020-3437

Cisco SD-WAN vManage Software information-disclosure vulnerability (CVE-2020-3437) enables an authenticated, remote attacker to read arbitrary files on the device filesystem via the web management interface due to insufficient file scope. Impact: partial confidentiality loss; CVSS vectors in publ...

CVE-2019-16002

CVE-2019-16002 affects Cisco SD-WAN Solution vManage Web UI. The issue stems from insufficient CSRF protections, allowing an unauthenticated, remote attacker to persuade a user to follow a malicious link and perform arbitrary actions with the user’s privileges. The vulnerability is documented in ...

CVE-2020-3387

Cisco SD-WAN vManage Software contains a remote code execution vulnerability (CVE-2020-3387) due to insufficient input sanitization during user authentication processing. An authenticated, remote attacker could exploit a crafted response to run commands with root privileges on an affected system....

CVE-2019-16012

Cisco SD-WAN Solution vManage web UI is vulnerable to SQL injection (CVE-2019-16012). An authenticated remote attacker can send malicious SQL via the web UI due to improper SQL value validation, potentially modifying or retrieving data from the underlying database and operating system. Cisco’s ad...

CVE-2020-3266

CVE-2020-3266 affects Cisco SD-WAN Solution CLI command injection via insufficient input validation. An authenticated, local attacker can submit crafted input to the CLI utility, resulting in arbitrary commands executed with root privileges. The vulnerability is documented across multiple sources...

CVE-2021-1278

CVE-2021-1278 is part of Cisco SD‑WAN DoS vulnerabilities affecting multiple Cisco SD‑WAN products. The connected sources indicate an unauthenticated, remote attacker can cause denial of service on affected devices (e.g., reboot or DoS) via the vulnerability set described in Cisco advisory Cisco ...

CVE-2021-1301

Cisco SD-WAN Buffer Overflow Vulnerabilities (CVE-2021-1301) affect Cisco SD-WAN products. The issues allow an unauthenticated, remote attacker to execute attacks against an affected device due to multiple buffer overflow vulnerabilities. CVSSv3.1 score is 9.8 (CRITICAL) with NETWORK attack vecto...

CVE-2021-1241

CVE-2021-1241 corresponds to Cisco SD-WAN DoS vulnerabilities in VPN tunneling features. The issue allows an unauthenticated, remote attacker to cause a reboot/DoS by sending crafted packets to affected devices. The vulnerability is part of Cisco SD-WAN product family (e.g., vEdge routers); root ...

CVE-2020-3265

Cisco SD-WAN Solution contains a privilege-escalation vulnerability (CVE-2020-3265) caused by insufficient input validation. An authenticated, local attacker can send a crafted request to an affected system to gain root-level privileges. Affected product: Cisco SD-WAN Solution software prior to 1...

CVE-2021-1262

CVE-2021-1262 concerns multiple command-injection vulnerabilities in Cisco SD-WAN products. An authenticated attacker could exploit these flaws to run commands on an affected device with root privileges . The CVE is discussed across multiple sources (including Cisco’s advisory), which confirms a ...

CVE-2021-1263

CVE-2021-1263 relates to multiple command‑injection vulnerabilities in Cisco SD‑WAN products. The connected sources confirm that an authenticated attacker could exploit the CLI to execute commands with root privileges on the device, compromising confidentiality, integrity, and potentially availab...

CVE-2020-3264

CVE-2020-3264 is a Cisco SD-WAN Solution buffer overflow vulnerability caused by insufficient input validation. It affects Cisco SD-WAN Solution software prior to 19.2.2. An authenticated, local attacker can exploit it by sending crafted traffic to an affected device, potentially gaining access t...

CVE-2021-1279

CVE-2021-1279 describes DoS vulnerabilities in Cisco SD-WAN products where an unauthenticated, remote attacker can crash/restart affected devices. The root cause cited is insufficient input validation in the SNMPv3 protocol implementation. Covered products include Cisco SD‑WAN edge devices and re...

CVE-2019-1951

CVE-2019-1951 concerns Cisco SD-WAN Solution packet filtering bypass. The vulnerability arises from improper traffic filtering conditions on affected devices, allowing an unauthenticated, remote attacker to bypass L3/L4 traffic filters by sending a crafted TCP packet, potentially injecting arbitr...

CVE-2021-1298

CVE-2021-1298 maps to multiple Cisco SD-WAN command injection vulnerabilities. The root cause is improper input validation in Cisco SD-WAN components allowing an authenticated attacker to execute commands with root privileges on affected devices. Affected products include Cisco SD-WAN solutions (...

CVE-2021-1299

CVE-2021-1299 refers to multiple command-injection flaws in Cisco SD-WAN product lines (notably SD-WAN vManage). The root cause is improper input validation in the device template configuration, allowing an authenticated attacker to inject commands and execute them with root privileges on the aff...

CVE-2021-1261

Cisco SD-WAN Command Injection Vulnerabilities (CVE-2021-1261) affect Cisco SD-WAN (Viptela) devices via input validation issues in the tcpdump utility. An authenticated, local attacker can inject commands, potentially executing with root privileges on the affected device. Several connected sourc...

CVE-2021-1274

CVE-2021-1274 describes a DoS weakness in Cisco SD-WAN software caused by a null dereference in vDaemon affecting UDP connection responses. Unauthenticated remote attackers can trigger a reboot/DoS by sending crafted traffic to affected devices. The vulnerability is associated with Cisco SD-WAN p...

CVE-2021-1305

Cisco SD-WAN vManageAuthorization Bypass vulnerabilities allow an authenticated, remote attacker to bypass authorization via the web-based management interface and access or view sensitive information. The issue stems from insufficient authorization checks in the vManage web UI, enabling potentia...

CVE-2021-1273

Cisco SD-WAN Denial of Service (DoS) vulnerabilities documented under CVE-2021-1273 affect Cisco SD-WAN software, including DoS through IPsec tunnel management and a UDP vDaemon null-dereference which can be exploited by unauthenticated remote attackers via crafted packets. The available sources ...

CVE-2021-1260

Cisco CVE-2021-1260 is a set of command-injection vulnerabilities in Cisco SD-WAN products. The advisory notes authenticated attackers could execute commands on affected devices, potentially gaining root privileges. Affected component is the SD-WAN CLI with insufficient input validation. Impact d...

CVE-2020-3381

CVE-2020-3381 affects Cisco SD-WAN vManage Software via the web management interface. The root cause is improper validation of uploaded files, enabling an authenticated, remote attacker to perform directory traversal and read/write arbitrary files. Documents indicate this vulnerability (CVE-2020-...

CVE-2020-3468

CVE-2020-3468 — Cisco SD-WAN vManage SQL Injection Affected product: Cisco SD-WAN vManage Software (web-based management interface). What’s vulnerable: The web interface improperly validates values within SQL queries, enabling an authenticated, remote attacker to inject SQL. Impact (as stated): A...

CVE-2020-3401

CVE-2020-3401 — Cisco SD-WAN vManage path traversal : A vulnerability in the web-based management interface could allow an authenticated, remote attacker to perform path traversal and read arbitrary files due to insufficient validation of HTTP requests. Some sources (CNVD) reference affected vers...

CVE-2020-3378

CVE-2020-3378 affects Cisco SD-WAN vManage Software. The root cause is an SQL injection in the web-based management interface caused by insufficient validation of user-supplied input. An authenticated, remote attacker could send crafted input that includes SQL statements to the affected system, e...

CVE-2020-3379

Cisco SD-WAN Solution Software has a privilege-escalation vulnerability due to insufficient input validation. An authenticated, local attacker can exploit a crafted request to gain administrative privileges on the underlying OS. Affected component is the Cisco SD-WAN Solution Software; impact is ...

CVE-2020-3385

CVE-2020-3385 affects Cisco SD-WAN vEdge Routers: the DoS stems from the DPI engine mishandling malformed packets. An unauthenticated, adjacent attacker can trigger a reboot by sending crafted packets, yielding a DoS condition. Documented impact: device reboot with availability impact. Affected c...

CVE-2020-3372

Cisco SD-WAN vManage Software is affected by a DoS vulnerability in the web-based management UI due to inefficient memory management. An authenticated, remote attacker can exploit this by sending a high volume of crafted HTTP requests, potentially exhausting system memory and causing the system t...

CVE-2020-3351

CVE-2020-3351 is a denial-of-service vulnerability in Cisco SD-WAN Solution Software caused by improper validation of fields in Cisco SD-WAN peering messages encapsulated in UDP packets. An unauthenticated, remote attacker can send crafted UDP messages to trigger a DoS affecting the targeted devi...

CVE-2020-3369

CVE-2020-3369 affects Cisco SD-WAN vEdge Routers where the DPI engine improperly processes FTP traffic, enabling an unauthenticated, remote attacker to cause a DoS by sending crafted FTP packets that can reboot the device. Affected appliances: Cisco SD-WAN vEdge Routers (and related 5000-series/C...

CVE-2019-16010

The CVE-2019-16010 issue affects Cisco SD-WAN vManage Web UI. The vulnerability stems from insufficient validation of user-supplied input in the web-based management interface, allowing an authenticated, remote attacker to lure a user into clicking a crafted link and execute arbitrary script code...

CVE-2020-3388

CVE-2020-3388 (Cisco SD-WAN vManage) involves an authenticated, local CLI input-validation flaw that allows command injection with root privileges. Affected: Cisco SD-WAN vManage Software CLI. Root cause: insufficient input validation enabling crafted CLI input to execute arbitrary commands as ro...

CVE-2020-3405

Cisco SD-WAN vManage Software is affected by CVE-2020-3405 due to improper handling of XML External Entity (XXE) entries during parsing of XML files in the web UI. The issue enables an authenticated, remote attacker to read and write files stored by the application by persuading a user to import ...

CVE-2020-3406

Cisco SD-WAN vManage Software's web-based management interface is affected by an XSS vulnerability (CVE-2020-3406) caused by improper validation of user-supplied input. An authenticated remote attacker could entice a user to click a crafted link to execute arbitrary script code in the interface c...