Cisco warnings include three high-impact SD-WAN vulnerabilities Credit: Jaredd Craig Cisco has issued five warnings about security weaknesses in its SD-WAN offerings, three of them on the high-end of the vulnerability scale. The worst problem is with the command-line interface (CLI) of its SD-WAN Solution software where a weakness could let a local attacker inject arbitrary commands that are executed with root privileges, Cisco wrote. An attacker could exploit this vulnerability – which has a 7.8 out if 10 on the Common Vulnerability Scoring System – by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. The vulnerability is due to insufficient input validation, Cisco wrote. Another high warning problem lets an authenticated, local attacker elevate privileges to root on the underlying operating system. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain root-level privileges, Cisco wrote. The vulnerability is due to insufficient input validation. The third high-level vulnerability in the SD-WAN Solution software could let an attacker cause a buffer overflow on an affected device. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to information that they are not authorized to access and make changes to the system that they are not authorized to make, Cisco wrote. The vulnerabilities affect a number of Cisco products if they are running a Cisco SD-WAN Solution software release earlier than Release 19.2.2: vBond Orchestrator Software, vEdge 100-5000 Series Routers, vManage Network Management System and vSmart Controller Software. Cisco said there were no workarounds for any of the vulnerabilities and it suggested users accept automatic software updates to allay exploit risks. There are software fixes for the problems as well. All three of the high-level warnings were reported to Cisco by the Orange Group, Cisco said. The other two SD-WAN Solution software warnings – with medium threat levels — include a one that allows a cross-site scripting (XSS) attack against the web-based management interface of the vManage software and SQL injection threat. The XXS vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or to access sensitive, browser-based information. The SQL vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could let the attacker modify values on, or return values from, the underlying database as well as the operating system, Cisco wrote. Cisco recognized Julien Legras and Thomas Etrillard of Synacktiv for reporting the problems. The company said release 19.2.2 of the Cisco SD-WAN Solution contains fixes for all five vulnerabilities. Related content analysis What is a virtual machine, and why are they so useful? Many of today’s IT innovations have their roots in virtual machines (VM) and their ability to separate software from hardware. By Keith Shaw May 03, 2024 9 mins Virtualization Data Center Networking analysis What is DNS and how does it work? The Domain Name System resolves the names of internet sites with their underlying IP addresses, adding efficiency and security in the process. By Josh Fruhlinger and Keith Shaw May 03, 2024 11 mins Internet Networking news Appeal court overturns $1.6bn mainframe software ‘poaching’ ruling against IBM AT&T ‘independently decided” to replace BMC software, the appeals court found. By John Leyden May 03, 2024 1 min Mainframes news Cisco, Red Hat extend networking, AI integrations Cisco and Red Hat will demo new network product integrations and introduce AI validated designs at the upcoming Red Hat Summit 2024. By Michael Cooney May 03, 2024 4 mins Network Virtualization Cloud Computing Networking PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe