Command Injection Vulnerability in Cisco SD-WAN Solution
CVE-2018-0347

7.8HIGH

Key Information:

Vendor
Cisco
Status
Cisco Sd-wan Solution Unknown
Vendor
CVE Published:
18 July 2018

Summary

A command injection vulnerability exists in the Zero Touch Provisioning subsystem of the Cisco SD-WAN Solution due to insufficient input validation. An authenticated local attacker may exploit this flaw by submitting specially crafted inputs that could execute arbitrary commands with root privileges on the affected devices. Successful exploitation allows attackers to potentially compromise the system integrity. This vulnerability affects various vEdge router models running versions prior to Release 18.3.0.

Affected Version(s)

Cisco SD-WAN Solution unknown Cisco SD-WAN Solution unknown

References

http://www.securityfocus.com/bid/104862
vdb-entryx_refsource_BID
https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.