Cisco SD-WAN Command Injection Vulnerabilities

Vulnerability

CVE-2021-1299 is a command injection vulnerability in the web-based management interface of Cisco SD-WAN vManage Software. The issue stems from improper input validation of user-supplied input when processing device template configuration. An authenticated, remote attacker can exploit this vulnerability by submitting crafted input to the device template configuration. This vulnerability affects only the Cisco SD-WAN vManage product; other Cisco SD-WAN components are not affected. Cisco has released software updates to address this vulnerability, but specific affected versions are not enumerated in the advisory [1].

Exploitation

To exploit this vulnerability, an attacker must have valid credentials with low privileges to access the Cisco SD-WAN vManage web interface. No user interaction is required. The attacker sends crafted input to the device template configuration endpoint. The input is not properly validated, allowing the injection of arbitrary commands that are executed with root privileges. The attack is network-based and does not require any special network positioning beyond reachability to the vManage management interface [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying system with root privileges. This results in complete compromise of the vManage instance, including full control over confidentiality, integrity, and availability. Since vManage is the central management platform for SD-WAN, the attacker could potentially manipulate network configurations and monitor or disrupt traffic across the entire SD-WAN fabric [1].

Mitigation

Cisco has released software updates that fix this vulnerability. There are no workarounds available. Users should upgrade to a fixed version of Cisco SD-WAN vManage Software as soon as possible. The advisory was published on January 20, 2021, and updates were available at that time. Cisco also notes that this vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog as of the advisory date [1].