Remote File Overwrite Vulnerability in Cisco SD-WAN Solution
CVE-2018-0349

9.8CRITICAL

Key Information:

Vendor
Cisco
Status
Cisco Sd-wan Solution Unknown
Vendor
CVE Published:
18 July 2018

Summary

A vulnerability exists within the Cisco SD-WAN Solution that enables an authenticated, remote attacker to overwrite arbitrary files on the device's operating system. This issue arises from insufficient input validation of the request admin-tech command in the command-line interface (CLI) of the software. By manipulating this command, attackers can exploit the vulnerability to overwrite critical system files, ultimately leading to privilege escalation to root user level. Affected products include various series of vEdge Routers and orchestration software provided by Cisco if they are operating on versions prior to Release 18.3.0.

Affected Version(s)

Cisco SD-WAN Solution unknown Cisco SD-WAN Solution unknown

References

https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/104854
vdb-entryx_refsource_BID

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.