Cisco addresses multiple issues in its SD
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-16012 | A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an aff A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on, or return values from, the underlying database as well as the operating system. NVD description · AI analysis pending | 8.1 group max | 54% |
| — |
Full article205 words · extracted from securityaffairs.com · click to collapse
Cisco has addressed a total of five vulnerabilities in its SD-WAN solution, including three high severity flaws.
Cisco has addressed five vulnerabilities in its SD-WAN solution, including three high severity flaws.
The vulnerabilities could be exploited by attackers to make unauthorized changes to the system, inject arbitrary commands that are executed with root permissions, and escalate privileges to root.
The flaws are all caused by insufficient input validation, they were discovered by experts at Orange Group.
Three high-severity vulnerabilities, tracked as CVE-2020-3265, CVE-2020-3266, CVE-2020-3264, could be exploited by a local, authenticated attacker by sending specially crafted requests or specially crafted input to the targeted system.
The vulnerabilities impact several Cisco products running an SD-WAN version prior to 19.2.2. The list of affected products includes vBond Orchestrator, vEdge routers, vManage network management software, and vSmart controller software.
The tech giant also addressed a stored Cross-Site Scripting flaw (CVE-2019-16010) and a SQL Injection flaw (CVE-2019-16012) in the SD-WAN Solution vManage.
Both issues could be remotely exploited by an authenticated attacker.
The good news is that the company is not aware of attacks in the wild that exploited the above flaws.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – CISCO SD-WAN, cyber security)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/99954/security/cisco-sd-wan-product-flaws.html