Cisco IOS XE SD-WAN Software Privilege Escalation Vulnerability

Vulnerability

A privilege escalation vulnerability exists in the Cisco IOS XE SD-WAN Software CLI, affecting devices running specific releases of Cisco IOS XE SD-WAN Software. The flaw is due to insufficient file system protection, allowing an authenticated local attacker with PRIV15 privileges to overwrite an installer file stored in the bootflash directory with arbitrary commands that execute with root-level privileges. The vulnerability is identified in Cisco Security Advisory [1] and affects software releases prior to the fixed versions indicated in the Cisco Software Checker [1].

Exploitation

To exploit this vulnerability, an attacker must already be authenticated on an affected device as a PRIV15 user, typically a network administrator with the highest level of CLI access. The attacker then leverages the insufficient protection by overwriting a specific installer file in the bootflash directory with crafted arbitrary commands. No user interaction is required beyond the attacker's authenticated session. The exact steps involve writing a malicious payload to the installer file location, which is then executed with root privileges during a subsequent installation process.

Impact

Successful exploitation allows the attacker to execute arbitrary commands with root-level privileges on the underlying operating system. This enables reading and writing changes to the configuration database on the affected device, effectively granting full control over the device and potentially the network segment it manages. The attacker can compromise the confidentiality, integrity, and availability of the device and its services.

Mitigation

Cisco has released software updates to address this vulnerability. Customers are advised to consult the Cisco Software Checker tool [1] to identify the earliest fixed release for their specific software version. If upgrading is not immediately possible, restricting PRIV15 access to trusted administrators is a general mitigation, but no explicit workaround is provided in the reference. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the advisory date.