Cisco fixed 5 security flaws in Cisco SD-WAN that allow attackers to make unauthorized changes to the system, and to execute the arbitrary commands.
Out of five, three are high severity flaws and the flaws are due to insufficient input validation, now Cisco released a fix for all the flaws.
CVE-2020-3265 – Privilege Escalation
The vulnerability in Cisco SD-WAN Solution software is due to insufficient input validation, it allows a local attacker to escalate the privileges to root on the vulnerable machine.
It affects all the Cisco products running Cisco SD-WAN Solution software release earlier than Release 19.2.2.
CVE-2020-3266 – Command Injection Vulnerability
The vulnerability resides in CLI of Cisco SD-WAN Solution software. it allows a local attacker to inject arbitrary commands with root privileges.
It affects all the Cisco products running Cisco SD-WAN Solution software release earlier than Release 19.2.2.
CVE-2020-3264 – Buffer Overflow Vulnerability
The vulnerability resides in Cisco SD-WAN Solution software allow an authenticated local attacker to cause a buffer overflow on the vulnerable device.
It affects all the Cisco products running Cisco SD-WAN Solution software release earlier than Release 19.2.2.
CVE-2019-16010 – Cross-Site Scripting Vulnerability
The vulnerability resides in the web UI of the Cisco SD-WAN vManage software that allows an authenticated remote attacker to launch a cross-site scripting (XSS) attack.
It affects all the Cisco products running Cisco SD-WAN Solution software release earlier than Release 19.2.2.
CVE-2019-16012 – SQL Injection Vulnerability
The vulnerability resides in the web UI of Cisco SD-WAN Solution that allows an authenticated remote attacker to conduct SQL injection attacks on an affected system.
It affects all the Cisco products running Cisco SD-WAN Solution software release earlier than Release 19.2.2.
Read More:
Cisco Webex Flaw Let Unauthenticated Remote Attackers to Join Private Meetings Without Password
