Authentication Vulnerability in Cisco SD-WAN vManage REST API

CVE-2023-20214

Summary

A security flaw exists in the request authentication validation for the REST API of Cisco SD-WAN vManage software, enabling an unauthenticated remote attacker to access configuration information. This vulnerability arises from inadequate request validation mechanisms in the REST API feature. An attacker might exploit this flaw by sending specially crafted API requests to gain unauthorized read access or limited write permissions to the configurations. It is important to note that the vulnerability is confined to the REST API and does not impact the web-based management interface or command-line interface (CLI).

References