Command Injection Vulnerability in Cisco SD-WAN vManage Dashboard
CVE-2018-0344

7.2HIGH

Key Information:

Vendor
Cisco
Status
Cisco Sd-wan Solution Unknown
Vendor
CVE Published:
18 July 2018

Summary

A vulnerability identified in the vManage dashboard for Cisco's SD-WAN Solution enables authenticated remote attackers to exploit insufficient input validation. By configuring a malicious username on the login page, attackers can inject and run arbitrary commands with the same privileges as the vmanage user. This could lead to unauthorized access and control over the affected systems. The vulnerability impacts various Cisco products that operate on versions preceding Release 18.3.0.

Affected Version(s)

Cisco SD-WAN Solution unknown Cisco SD-WAN Solution unknown

References

https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/104868
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.