Cisco SD-WAN Solution vManage Cross-Site Request Forgery Vulnerability

Vulnerability

The vulnerability is a cross-site request forgery (CSRF) in the web-based UI of Cisco vManage, part of the Cisco SD-WAN Solution. It exists because the web UI has insufficient CSRF protections. Affected versions are Cisco vManage Software releases earlier than 19.2.0 as of the advisory publication date [1].

Exploitation

An unauthenticated, remote attacker can exploit this by persuading a logged-in user (with any privilege level) to follow a malicious link (e.g., via email or a website). No other authentication or specific network position is required; the attacker just needs to craft a request that the victim's browser will execute in the context of the vManage session [1].

Impact

A successful CSRF exploit allows the attacker to perform arbitrary actions on the vManage instance with the privilege level of the victim user. This could range from configuration changes to data modification or deletion, depending on the victim's permissions [1].

Mitigation

Cisco has released software updates in release 19.2.0 and later to address this vulnerability. There are no workarounds. Users should upgrade to a fixed version as indicated in the Cisco Security Advisory [1].