Cisco warns of five SD-WAN security weaknesses

Cisco has issued five  warnings about security weaknesses in its SD-WAN offerings, three of them on the high-end of the vulnerability scale.

The worst problem is with the command-line interface (CLI) of its SD-WAN Solution software where a weakness could let a local attacker inject arbitrary commands that are executed with root privileges, Cisco wrote.

An attacker could exploit this vulnerability – which has a 7.8 out if 10 on  the Common Vulnerability Scoring System – by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. The vulnerability is due to insufficient input validation, Cisco wrote.

Another high warning problem lets an authenticated, local attacker elevate privileges to root on the underlying operating system.  An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain root-level privileges, Cisco wrote.  The vulnerability is due to insufficient input validation.

The third high-level vulnerability in the SD-WAN Solution software could let an attacker cause a buffer overflow on an affected device. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to information that they are not authorized to access and make changes to the system that they are not authorized to make, Cisco wrote.

The vulnerabilities affect a number of Cisco products if they are running a Cisco SD-WAN Solution software release earlier than Release 19.2.2: vBond Orchestrator Software, vEdge 100-5000 Series Routers, vManage Network Management System and vSmart Controller Software.

Cisco said there were no workarounds for any of the vulnerabilities and it suggested users accept automatic software updates to allay exploit risks. There are software fixes for the problems as well. 

All three of the high-level warnings were reported to Cisco by the Orange Group, Cisco said.

The other two SD-WAN Solution software warnings – with medium threat levels — include a one that allows a cross-site scripting (XSS) attack against the web-based management interface of the vManage software and SQL injection threat.

The XXS vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or to access sensitive, browser-based information.

The SQL vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could let the attacker  modify values on, or return values from, the underlying database as well as the operating system, Cisco wrote.

Cisco recognized Julien Legras and Thomas Etrillard of Synacktiv for reporting the problems.

The company said release 19.2.2 of the Cisco SD-WAN Solution contains fixes for all five vulnerabilities.