Cisco SD-WAN Command Injection Vulnerabilities

CVE numbers – CVE-2021-1260, CVE-2021-1261, CVE-2021-1262, CVE-2021-1263, CVE-2021-1298, CVE-2021-1299

Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device.

Vulnerable Products

These vulnerabilities affect the following Cisco products if they are running a vulnerable release of Cisco SD-WAN Software:

  • SD-WAN vBond Orchestrator Software
  • SD-WAN vEdge Cloud Routers
  • SD-WAN vEdge Routers
  • SD-WAN vManage Software
  • SD-WAN vSmart Controller Software
  • CVE-2021-1299: Cisco SD-WAN vManage Command Injection Vulnerability
  • A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected system.This vulnerability is due to improper input validation of user-supplied input to the device template configuration. An attacker could exploit this vulnerability by submitting crafted input to the device template configuration. A successful exploit could allow the attacker to gain root-level access to the affected system.This vulnerability affects only the Cisco SD-WAN vManage product.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Bug ID(s): CSCvu28387
    CVE ID: CVE-2021-1299
    Security Impact Rating (SIR): Critical
    CVSS Base Score: 9.9
    CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CVE-2021-1261: Cisco SD-WAN CLI Command Injection Vulnerability
  • A vulnerability in the CLI utility tcpdump of Cisco SD-WAN Software could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow the attacker to obtain root privileges.This vulnerability is due to insufficient validation of user-supplied input to the tcpdump command. An attacker could exploit this vulnerability by authenticating with a lower-privileged user account via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Bug ID(s): CSCvi59639
    CVE ID: CVE-2021-1261
    Security Impact Rating (SIR): High
    CVSS Base Score: 7.8
    CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2021-1260: Cisco SD-WAN CLI Command Injection Vulnerability
  • A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow the attacker to obtain root privileges and read, write, and delete files of the underlying file system of an affected device.This vulnerability is due to insufficient validation of user-supplied input on the CLI. An attacker could exploit this vulnerability by authenticating with read-only privileges via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Bug ID(s): CSCvi59635
    CVE ID: CVE-2021-1260
    Security Impact Rating (SIR): High
    CVSS Base Score: 7.1
    CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
  • CVE-2021-1263: Cisco SD-WAN CLI Command Injection Vulnerability
  • A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow the attacker to obtain root privileges and read, write, and delete files of the underlying file system of an affected device.This vulnerability is due to insufficient validation of user-supplied input on the CLI. An attacker could exploit this vulnerability by authenticating with read-only privileges via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Bug ID(s): CSCvu28443
    CVE ID: CVE-2021-1263
    Security Impact Rating (SIR): Medium
    CVSS Base Score: 6.1
    CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
  • CVE-2021-1262: Cisco SD-WAN CLI Command Injection Vulnerability
  • A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow the attacker to obtain root privileges and read files from the underlying file system of an affected device.This vulnerability is due to insufficient validation of user-supplied input on the CLI. An attacker could exploit this vulnerability by authenticating with read-only privileges via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Bug ID(s): CSCvi69982
    CVE ID: CVE-2021-1262
    Security Impact Rating (SIR): Medium
    CVSS Base Score: 5.5
    CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  • CVE-2021-1298: Cisco SD-WAN vManage Command Injection Vulnerability
  • A vulnerability in the vAnalytics feature of the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected system.This vulnerability is due to improper input validation of user-supplied input to the SSO configuration. An attacker could exploit this by submitting crafted input to the SSO configuration. A successful exploit could allow the attacker to gain root-level access to the system.The vAnalytics feature of Cisco SD-WAN vManage Software must be enabled for this vulnerability to be exploited.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Bug ID(s): CSCvm26011
    CVE ID: CVE-2021-1298
    Security Impact Rating (SIR): Medium
    CVSS Base Score: 5.3
    CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Workarounds

  • There are no workarounds that address these vulnerabilities.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn

Duncan Newell

Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: