Cisco SD-WAN vManage Software Vulnerability

CVE-2021-1491

Summary

A vulnerability exists within the web-based management interface of Cisco SD-WAN vManage Software, which permits an authenticated remote attacker to read arbitrary files situated on the device's underlying file system. This flaw stems from inadequate file scope restrictions that enable potential exploitation by referencing specific files in the system. Through the management interface, an attacker can successfully access these files, leading to unauthorized information disclosure. Cisco has issued software updates to rectify this issue. Unfortunately, there are no current workarounds available to mitigate this vulnerability.

References