Cisco SD-WAN Command Injection Vulnerabilities

Vulnerability

This command injection vulnerability (CVE-2021-1260) exists in the web-based management interface of Cisco SD-WAN vManage Software. The flaw is due to improper input validation of user-supplied input to the device template configuration. Affected versions are not explicitly listed in the advisory, but the advisory states that Cisco has released software updates to address the vulnerability [1]. The vulnerability is not dependent on other vulnerabilities disclosed in the same advisory.

Exploitation

An authenticated, remote attacker can exploit this vulnerability by submitting crafted input to the device template configuration [1]. No user interaction beyond authentication is required, and the attacker does not need any special privileges beyond a valid account on the vManage system.

Impact

Successful exploitation allows the attacker to execute arbitrary commands with root privileges on the affected vManage system, leading to full compromise of the device's confidentiality, integrity, and availability (CIA) [1]. The CVSS base score is 9.9 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Mitigation

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability [1]. Users should upgrade to the fixed version as indicated by Cisco. The vulnerability is not known to be listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.