Cisco IOS XE SD-WAN Software Arbitrary File Overwrite Vulnerability

Vulnerability

The vulnerability exists in the CLI of Cisco IOS XE SD-WAN Software. It allows an authenticated, local attacker to overwrite arbitrary files on the system due to improper access controls on files within the local file system. By placing a symbolic link in a specific location, the attacker can cause the system to follow the link and overwrite the target file. This affects Cisco IOS XE SD-WAN Software versions prior to the fixed release; details are available in the Cisco Security Advisory [1].

Exploitation

An attacker must have local authenticated access to the device. The attacker then creates a symbolic link in a specific location on the local file system. When the system accesses that location, it follows the symlink and overwrites the target file. No additional user interaction is required beyond authentication.

Impact

Successful exploitation allows the attacker to overwrite arbitrary files on the local system. This could result in denial of service, privilege escalation, or further compromise depending on the overwritten file's role.

Mitigation

Cisco has released software updates to address this vulnerability. Users should upgrade to a fixed version as indicated in the Cisco Security Advisory [1]. No workaround is available. The Cisco Software Checker tool can help determine the appropriate fixed release.