Remote Code Execution Vulnerability in Cisco SD-WAN Solution
CVE-2018-0343

8.8HIGH

Key Information:

Vendor
Cisco
Status
Cisco Sd-wan Solution Unknown
Vendor
CVE Published:
18 July 2018

Summary

A vulnerability in the configuration and management service of Cisco's SD-WAN Solution can enable an authenticated, remote attacker to execute arbitrary code or create a denial of service condition on affected systems. This flaw arises from inadequate access restrictions on the HTTP management interface, allowing attackers to send malicious HTTP requests. Successful exploitation grants the attacker vmanage user privileges, leading to potential system manipulation and service interruptions. This issue impacts various Cisco products running versions prior to Release 18.3.0.

Affected Version(s)

Cisco SD-WAN Solution unknown Cisco SD-WAN Solution unknown

References

https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/104861
vdb-entryx_refsource_BID

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.