Cisco SD-WAN vManage Software Vulnerability

CVE-2021-1483

Summary

A security flaw in the web UI of Cisco SD-WAN vManage Software could allow an authenticated remote attacker to manipulate and access sensitive information stored on the system. This vulnerability arises from the improper handling of XML External Entity (XXE) inputs when the software parses certain XML files. Attackers could exploit this weakness by convincing a user to import a specially crafted XML file containing malicious entries. If successfully exploited, this vulnerability could enable the attacker to obtain and modify files within the affected application. Cisco has promptly issued software updates to rectify this issue; however, no alternative workarounds are available to mitigate the risk.

References