Cisco IOS XE SD-WAN Software Command Injection Vulnerability

Vulnerability

A command injection vulnerability exists in the CLI of Cisco IOS XE SD-WAN Software. The issue is due to insufficient input validation by the system CLI, allowing crafted input to be executed as commands on the underlying operating system. Affected versions include all releases prior to the fixed versions specified in the Cisco Security Advisory [1]. The attacker must have privileges to run commands on the device.

Exploitation

An attacker with local terminal access or a management shell interface authenticates to an affected device. The attacker then submits crafted input to the system CLI. The exploitation requires authenticated access with command-running privileges, but no special privileges beyond that are needed to trigger the injection [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with root-level privileges. An attacker with limited user privileges can gain complete control over the system, including the ability to modify configurations, access sensitive data, and disrupt services [1].

Mitigation

Cisco has released free software updates to address this vulnerability. Customers with service contracts should obtain fixes through their usual update channels. Customers without service contracts should contact the Cisco Technical Assistance Center (TAC) [1]. No workarounds are mentioned in the available reference.