Cisco SD-WAN vManage Command Injection Vulnerability

Vulnerability

The vulnerability exists in the WebUI of Cisco SD-WAN vManage releases earlier than 18.3.0. It is due to insufficient input validation of data parameters for certain fields. An authenticated attacker can inject arbitrary commands by configuring a malicious username on the login page [1].

Exploitation

An attacker needs valid authentication credentials to access the WebUI. The exploit is performed by entering a crafted username string that includes command injection payloads during the login process. No additional user interaction is required beyond the attacker's own actions [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands with vmanage user privileges on the affected system. This can lead to full compromise of the SD-WAN management plane, including potential data exfiltration, configuration modification, and further lateral movement [1].

Mitigation

Cisco has released software updates that address this vulnerability. Fixed version is Release 18.3.0 and later. There are no workarounds available. Users should upgrade to a patched release as soon as possible [1].