Authentication Bypass in Cisco's SD-WAN vManage Software Affecting Elasticsearch Database

CVE-2023-20034

Summary

A vulnerability exists in the Elasticsearch database used by Cisco's SD-WAN vManage software, allowing an unauthenticated remote attacker to gain access to the configuration database. This issue arises from a static username and password configuration on the vManage, enabling an attacker to exploit the vulnerability by sending a specially crafted HTTP request to the exposed vManage interface on port 9200. If successfully exploited, the attacker could retrieve sensitive information from the Elasticsearch database. Cisco has provided workarounds to mitigate this issue.

References