Cisco IOS XE SD-WAN Software Command Injection Vulnerability

Vulnerability

A command injection vulnerability exists in the CLI of Cisco IOS XE SD-WAN Software and Cisco IOS XE Software due to insufficient validation of arguments passed to certain CLI commands [1]. This affects multiple releases of both software families; the exact affected versions are detailed in the Cisco Security Advisory [1]. The vulnerability is reachable when an authenticated user executes a vulnerable CLI command with crafted input.

Exploitation

An attacker must have valid user credentials to authenticate locally on the affected device [1]. The attacker then includes malicious input in the argument of an affected CLI command. No additional privileges or user interaction beyond authentication are required. The attack does not require network access beyond the local console or SSH session.

Impact

Successful exploitation allows the attacker to execute arbitrary commands with elevated privileges on the underlying operating system [1]. This results in full compromise of the device, including potential data disclosure, modification, or denial of service, depending on the commands executed.

Mitigation

Cisco has released software updates to address this vulnerability; the fixed releases are identified in the Cisco Security Advisory [1]. Customers should use the Cisco Software Checker to determine their exposure and upgrade to a fixed version. No workarounds are available. Devices that are end-of-life may not receive a fix.