Cisco SD-WAN vManage Software Vulnerability: SQL Injection Attacks Possible

CVE-2021-1470

Summary

A vulnerability exists in the web-based management interface of Cisco's SD-WAN vManage Software, allowing authenticated remote attackers to perform SQL injection attacks. This vulnerability stems from inadequate input validation for SQL queries. By authenticating to the application, attackers can send crafted SQL queries, potentially leading to unauthorized access to modify or retrieve information from the vManage database or the operating system beneath it. Cisco recommends applying the released software updates to mitigate this issue, as no workarounds effectively address the vulnerability.

References