Cisco SD-WAN Solution Unauthorized Access Vulnerability

Vulnerability

In Cisco SD-WAN Solution, an insecure default configuration allows an authenticated, adjacent attacker to bypass authentication and gain direct unauthorized access to other vSmart containers. This affects Cisco SD-WAN Solution releases prior to the fixed version mentioned in the security advisory [1]. The attacker can connect directly to exposed services that should be restricted.

Exploitation

An attacker must have authenticated access to the SD-WAN network and be adjacent (i.e., within the same Layer 2 network) to the target vSmart containers. The attacker then directly connects to the exposed services, bypassing the intended authentication. No user interaction is required beyond initial authentication.

Impact

Successful exploitation allows the attacker to retrieve and modify critical system files on other vSmart containers, leading to full compromise of the SD-WAN control plane, including disclosure of sensitive information and potential disruption of network operations.

Mitigation

Cisco has released free software updates to address this vulnerability. Customers should upgrade to a fixed version as indicated in the Cisco Security Advisory [1]. No workarounds are available. As of the advisory date, the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.