EXECUTIVE SUMMARY:
Multiple security vulnerabilities have been identified in Cisco SD-WAN Manager (formerly vManage) versions prior to the upcoming release. The flaws include a command injection vulnerability that enables remote code execution and privilege escalation to root, as well as related weaknesses that can be leveraged for unauthorized configuration changes on edge devices. Exploitation requires an authenticated attacker with netadmin rights, but chaining with other exploits can lower the barrier. Successful attacks allow adversaries to execute arbitrary commands, alter network policies, and potentially gain full control of the SD‑WAN infrastructure, exposing corporate data and disrupting critical services.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple security vulnerabilities have been identified in Cisco SD-WAN Manager (formerly vManage) versions prior to the upcoming release. The flaws include a command injection vulnerability that enables remote code execution and privilege escalation to root, as well as related weaknesses that can be leveraged for unauthorized configuration changes on edge devices. Exploitation requires an authenticated attacker with netadmin rights, but chaining with other exploits can lower the barrier. Successful attacks allow adversaries to execute arbitrary commands, alter network policies, and potentially gain full control of the SD‑WAN infrastructure, exposing corporate data and disrupting critical services.[emaillocker id="1283"]
The combined risk is high and requires immediate attention, as active exploitation has been observed in the wild. If leveraged, attackers can seize control of SD‑WAN devices, disrupt connectivity, and compromise sensitive corporate data, leading to operational downtime and reputational damage.
RECOMMENDATION:
REFERENCES:
The following reports contain further technical details:
https://securityonline.info/cisco-sd-wan-vulnerability-exploited/