CVE-2018-0344

Vulnerability

A command injection vulnerability exists in the vManage dashboard of the Cisco SD-WAN Solution due to insufficient input validation of data parameters for certain fields [1]. An authenticated, remote attacker can inject and execute arbitrary commands with vmanage user privileges. This affects the following Cisco products running a release prior to Release 18.3.0: vBond Orchestrator Software, vEdge 100 Series Routers, vEdge 1000 Series Routers, vEdge 2000 Series Routers, vEdge 5000 Series Routers, vEdge Cloud Router Platform, vManage Network Management Software, and vSmart Controller Software [1].

Exploitation

An attacker must have authenticated access to the vManage dashboard. The exploit is performed by configuring a malicious username on the login page of the affected solution [1]. The attacker crafts a username containing command injection payloads, which are then executed due to the lack of proper input validation. No additional user interaction is required beyond the initial authentication.

Impact

Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the vmanage user [1]. This can lead to full compromise of the SD-WAN management plane, including the ability to modify network configurations, access sensitive data, and potentially pivot to other devices in the SD-WAN fabric.

Mitigation

Cisco released fixed software in the Cisco SD-WAN Solution Release 18.3.0 [1]. No workarounds are available. Users should upgrade to a fixed release as soon as possible. Refer to the Cisco Security Advisory for detailed upgrade instructions [1].