Cisco SD-WAN Command Injection Vulnerabilities

Vulnerability

Multiple command injection vulnerabilities exist in Cisco SD-WAN products, including vManage (CVE-2021-1299) and the CLI utility tcpdump (CVE-2021-1261). The vManage flaw arises from improper input validation in the device template configuration interface, while the CLI flaw stems from insufficient validation in the tcpdump command. Affected versions include Cisco SD-WAN vManage and Cisco SD-WAN Software releases prior to patched versions. [1]

Exploitation

For the vManage vulnerability (CVE-2021-1299), an attacker must be an authenticated remote user with access to the web-based management interface. The attacker exploits the flaw by submitting crafted input to the device template configuration. For the CLI vulnerability (CVE-2021-1261), an attacker needs local, read-only access to the device CLI and then submits crafted input to the tcpdump command. [1]

Impact

Successful exploitation of either vulnerability allows the attacker to execute arbitrary commands with root privileges on the affected system. The vManage vulnerability yields remote root-level access, while the CLI vulnerability grants root privileges locally. The overall impact is a complete compromise of confidentiality, integrity, and availability. [1]

Mitigation

Cisco has released software updates addressing both vulnerabilities. No workarounds are available. The advisory does not specify a fixed version release date, but users should apply the latest updates from Cisco. No KEV listing is noted in the available references. [1]