Cisco addresses multiple issues in its SD-WAN product

Cisco has addressed a total of five vulnerabilities in its SD-WAN solution, including three high severity flaws.

Cisco has addressed five vulnerabilities in its SD-WAN solution, including three high severity flaws.

The vulnerabilities could be exploited by attackers to make unauthorized changes to the system, inject arbitrary commands that are executed with root permissions, and escalate privileges to root.

The flaws are all caused by insufficient input validation, they were discovered by experts at Orange Group.

Three high-severity vulnerabilities, tracked as CVE-2020-3265, CVE-2020-3266, CVE-2020-3264, could be exploited by a local, authenticated attacker by sending specially crafted requests or specially crafted input to the targeted system.

The vulnerabilities impact several Cisco products running an SD-WAN version prior to 19.2.2. The list of affected products includes vBond Orchestrator, vEdge routers, vManage network management software, and vSmart controller software.

The tech giant also addressed a stored Cross-Site Scripting flaw (CVE-2019-16010) and a SQL Injection flaw (CVE-2019-16012) in the SD-WAN Solution vManage.

Both issues could be remotely exploited by an authenticated attacker.

The good news is that the company is not aware of attacks in the wild that exploited the above flaws.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – CISCO SD-WAN, cyber security)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.