Cisco SD-WAN Solution Certificate Validation Vulnerability

Vulnerability

A certificate validation vulnerability exists in the Zero Touch Provisioning (ZTP) feature of Cisco SD-WAN Solution software. The affected software [1] fails to properly validate certificates supplied during the provisioning process. This missing validation allows an unauthenticated, remote attacker to present a crafted certificate to an affected device. The vulnerable component is part of ZTP, which is designed to automatically configure new devices upon initial boot. Affected versions are those prior to the fixed releases described in Cisco Security Advisory cisco-sa-20180905-sd-wan-validation [1].

Exploitation

To exploit this vulnerability, an attacker must be in a network position that allows interception of the provisioning traffic between the new device and the Cisco SD-WAN controller, or the attacker must be able to supply a crafted certificate to the device during the ZTP process [1]. The attacker does not require any prior authentication. The attack can be mounted remotely without user interaction. By presenting an invalid or crafted certificate that the device wrongly trusts, the attacker can insert themselves into the communication path.

Impact

A successful exploit allows the attacker to perform man-in-the-middle (MITM) attacks [1]. The attacker can then decrypt confidential information on user connections to the affected software, leading to unauthorized disclosure of sensitive data. The impact is primarily on confidentiality, as the attacker can intercept and read data that the user believes is encrypted with a legitimate certificate [1].

Mitigation

Cisco has released free software updates to address this vulnerability [1]. The fixed versions are specified in the Cisco Security Advisory cisco-sa-20180905-sd-wan-validation. Customers with valid service contracts should upgrade to the appropriate fixed release. No workarounds or mitigations are described in the advisory for environments unable to immediately patch [1].