Multiple vulnerabilities in Cisco SD-WAN
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 6 |
| CVE-ID | CVE-2021-1260 CVE-2021-1261 CVE-2021-1262 CVE-2021-1263 CVE-2021-1298 CVE-2021-1299 |
| CWE-ID | CWE-77 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Cisco SD-WAN Client/Desktop applications / Virtualization software Cisco SD-WAN vBond Orchestrator Other software / Other software solutions Cisco SD-WAN vManage Other software / Other software solutions Cisco SD-WAN vEdge Cloud Router Hardware solutions / Routers & switches, VoIP, GSM, etc Cisco SD-WAN vEdge Routers Hardware solutions / Routers & switches, VoIP, GSM, etc Cisco SD-WAN vSmart Controller Hardware solutions / Other hardware appliances |
| Vendor | Cisco Systems, Inc |
Security Bulletin
This security bulletin contains information about 6 vulnerabilities.
1) Command Injection
EUVDB-ID: #VU49892
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-1260
CWE-ID:
CWE-77 - Command injection
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation in the CLI. A local user can pass specially crafted data to the application and execute arbitrary commands on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCisco SD-WAN: 18.3.0 - 20.4.0
Cisco SD-WAN vBond Orchestrator: All versions
Cisco SD-WAN vEdge Cloud Router: All versions
Cisco SD-WAN vEdge Routers: All versions
Cisco SD-WAN vManage: All versions
Cisco SD-WAN vSmart Controller: All versions
External linkshttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Command Injection
EUVDB-ID: #VU49893
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-1261
CWE-ID:
CWE-77 - Command injection
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation in the CLI utility tcpdump. A local user can pass specially crafted data to the application and execute arbitrary commands on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCisco SD-WAN: 18.3.0 - 20.4.0
Cisco SD-WAN vBond Orchestrator: All versions
Cisco SD-WAN vEdge Cloud Router: All versions
Cisco SD-WAN vEdge Routers: All versions
Cisco SD-WAN vManage: All versions
Cisco SD-WAN vSmart Controller: All versions
External linkshttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Command Injection
EUVDB-ID: #VU49894
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-1262
CWE-ID:
CWE-77 - Command injection
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation in the CLI. A local user can pass specially crafted data to the application and execute arbitrary commands on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCisco SD-WAN: 18.3.0 - 20.4.0
Cisco SD-WAN vBond Orchestrator: All versions
Cisco SD-WAN vEdge Cloud Router: All versions
Cisco SD-WAN vEdge Routers: All versions
Cisco SD-WAN vManage: All versions
Cisco SD-WAN vSmart Controller: All versions
External linkshttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Command Injection
EUVDB-ID: #VU49895
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-1263
CWE-ID:
CWE-77 - Command injection
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation in the CLI. A local user can pass specially crafted data to the application and execute arbitrary commands on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCisco SD-WAN: 18.3.0 - 20.4.0
Cisco SD-WAN vBond Orchestrator: All versions
Cisco SD-WAN vEdge Cloud Router: All versions
Cisco SD-WAN vEdge Routers: All versions
Cisco SD-WAN vManage: All versions
Cisco SD-WAN vSmart Controller: All versions
External linkshttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Command Injection
EUVDB-ID: #VU49896
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-1298
CWE-ID:
CWE-77 - Command injection
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation in the vAnalytics feature. A remote authenticated attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCisco SD-WAN: 18.3.0 - 20.4.0
Cisco SD-WAN vManage: All versions
External linkshttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Command Injection
EUVDB-ID: #VU49897
Risk: Medium
CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-1299
CWE-ID:
CWE-77 - Command injection
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation in the web-based management interface. A remote authenticated attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCisco SD-WAN: 18.3.0 - 20.4.0
Cisco SD-WAN vManage: All versions
External linkshttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
