Access Control Flaw in Cisco SD-WAN vManage Management Interface

CVE-2023-20253

What is CVE-2023-20253?

A vulnerability has been identified in the command line interface (CLI) management component of Cisco SD-WAN vManage. This flaw allows an authenticated local attacker with low-privilege access to bypass authorization measures. By exploiting this vulnerability, the attacker can send requests to manipulate the configuration of vManage controllers and edge routers within the affected system, specifically allowing them to roll back configurations on other connected devices. The root cause lies in improper access controls, enabling unauthorized actions despite user privilege levels.

References