Cisco SD-WAN Software Information Disclosure Vulnerability

Vulnerability

A vulnerability in the Multiprotocol Label Switching (MPLS) packet handling function of Cisco SD-WAN Software allows an unauthenticated, remote attacker to read sensitive information from MPLS buffer memory. The issue stems from insufficient validation of malformed MPLS packets processed by affected devices. Affected versions include Cisco SD-WAN Software releases 18.4 (before 18.4.6), 19.2 (before 19.2.3), 20.3 (before 20.3.2), 20.4 (before 20.4.1), and 20.5 (before 20.5.1). Cisco SD-WAN vManage Software is also listed as affected in the advisory [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted MPLS packet to an affected device running Cisco SD-WAN Software or Cisco SD-WAN vManage Software. No authentication or prior access is required; the attacker only needs network reachability to the target device. The malformed packet triggers the insufficient handling logic, allowing the attacker to access buffer memory contents.

Impact

Successful exploitation results in unauthorized disclosure of sensitive information stored in MPLS buffer memory. The impact is limited to information disclosure; no code execution, privilege escalation, or denial of service is described in the available references [1].

Mitigation

Cisco has released fixed software versions to address this vulnerability. The first fixed releases are 18.4.6, 19.2.3, 20.3.2, 20.4.1, and 20.5.1. Customers should upgrade to these or later releases. No workarounds are documented. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication [1].