Cisco SD-WAN Command Injection Vulnerabilities

CVE numbers – CVE-2021-1260, CVE-2021-1261, CVE-2021-1262, CVE-2021-1263, CVE-2021-1298, CVE-2021-1299

Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device.

Vulnerable Products

These vulnerabilities affect the following Cisco products if they are running a vulnerable release of Cisco SD-WAN Software:

• SD-WAN vBond Orchestrator Software
• SD-WAN vEdge Cloud Routers
• SD-WAN vEdge Routers
• SD-WAN vManage Software
• SD-WAN vSmart Controller Software

• CVE-2021-1299: Cisco SD-WAN vManage Command Injection Vulnerability
• A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected system.This vulnerability is due to improper input validation of user-supplied input to the device template configuration. An attacker could exploit this vulnerability by submitting crafted input to the device template configuration. A successful exploit could allow the attacker to gain root-level access to the affected system.This vulnerability affects only the Cisco SD-WAN vManage product.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Bug ID(s): CSCvu28387
  CVE ID: CVE-2021-1299
  Security Impact Rating (SIR): Critical
  CVSS Base Score: 9.9
  CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• CVE-2021-1261: Cisco SD-WAN CLI Command Injection Vulnerability
• A vulnerability in the CLI utility tcpdump of Cisco SD-WAN Software could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow the attacker to obtain root privileges.This vulnerability is due to insufficient validation of user-supplied input to the tcpdump command. An attacker could exploit this vulnerability by authenticating with a lower-privileged user account via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Bug ID(s): CSCvi59639
  CVE ID: CVE-2021-1261
  Security Impact Rating (SIR): High
  CVSS Base Score: 7.8
  CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• CVE-2021-1260: Cisco SD-WAN CLI Command Injection Vulnerability
• A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow the attacker to obtain root privileges and read, write, and delete files of the underlying file system of an affected device.This vulnerability is due to insufficient validation of user-supplied input on the CLI. An attacker could exploit this vulnerability by authenticating with read-only privileges via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Bug ID(s): CSCvi59635
  CVE ID: CVE-2021-1260
  Security Impact Rating (SIR): High
  CVSS Base Score: 7.1
  CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• CVE-2021-1263: Cisco SD-WAN CLI Command Injection Vulnerability
• A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow the attacker to obtain root privileges and read, write, and delete files of the underlying file system of an affected device.This vulnerability is due to insufficient validation of user-supplied input on the CLI. An attacker could exploit this vulnerability by authenticating with read-only privileges via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Bug ID(s): CSCvu28443
  CVE ID: CVE-2021-1263
  Security Impact Rating (SIR): Medium
  CVSS Base Score: 6.1
  CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
• CVE-2021-1262: Cisco SD-WAN CLI Command Injection Vulnerability
• A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow the attacker to obtain root privileges and read files from the underlying file system of an affected device.This vulnerability is due to insufficient validation of user-supplied input on the CLI. An attacker could exploit this vulnerability by authenticating with read-only privileges via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Bug ID(s): CSCvi69982
  CVE ID: CVE-2021-1262
  Security Impact Rating (SIR): Medium
  CVSS Base Score: 5.5
  CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• CVE-2021-1298: Cisco SD-WAN vManage Command Injection Vulnerability
• A vulnerability in the vAnalytics feature of the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected system.This vulnerability is due to improper input validation of user-supplied input to the SSO configuration. An attacker could exploit this by submitting crafted input to the SSO configuration. A successful exploit could allow the attacker to gain root-level access to the system.The vAnalytics feature of Cisco SD-WAN vManage Software must be enabled for this vulnerability to be exploited.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Bug ID(s): CSCvm26011
  CVE ID: CVE-2021-1298
  Security Impact Rating (SIR): Medium
  CVSS Base Score: 5.3
  CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Workarounds

• There are no workarounds that address these vulnerabilities.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn