Cisco SD-WAN vManage Software Vulnerabilities

Vulnerability

Cisco SD-WAN vManage Software is affected by multiple vulnerabilities that could allow an unauthenticated, remote attacker to execute arbitrary code or an authenticated, local attacker to gain escalated privileges. The exact nature of the vulnerabilities is detailed in [1].

Exploitation

For remote code execution, an unauthenticated attacker can exploit the vulnerability over the network without any user interaction. For local privilege escalation, an attacker must have valid credentials and local access to the system.

Impact

Successful exploitation of the remote code execution vulnerability grants the attacker arbitrary code execution on the affected system. Exploitation of the local privilege escalation vulnerability allows an attacker to gain higher privileges, potentially leading to full system compromise.

Mitigation

Cisco has released free software updates to address these vulnerabilities. Users are advised to upgrade to the fixed versions indicated in [1]. No workarounds are available.