—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Cisco Security Advisory: Cisco SD-WAN Solution CLI Command Injection Vulnerability

Advisory ID: cisco-sa-20180718-sdwan-cmdnjct

Revision: 1.0

For Public Release: 2018 July 18 16:00 GMT

Last Updated: 2018 July 18 16:00 GMT

CVE ID(s): CVE-2018-0348

CVSS Score v(3): 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

+———————————————————————

Summary

=======

A vulnerability in the CLI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges.

The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting malicious input to the load command within the VPN subsystem.

The attacker must be authenticated to access the affected CLI parameter. A successful exploit could allow an attacker to execute commands with root privileges.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sdwan-cmdnjct [“https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sdwan-cmdnjct”]

—–BEGIN PGP SIGNATURE—–

iQJ5BAEBAgBjBQJbT2a7XBxDaXNjbyBQcm9kdWN0IFNlY3VyaXR5IEluY2lkZW50
IFJlc3BvbnNlIFRlYW0gKENpc2NvIFBTSVJUIGtleSAyMDE4LTIwMTkpIDxwc2ly
dEBjaXNjby5jb20+AAoJEJa12PPJBfczoMoQAJhSI4/3kLVWusrru3gVKuYCNLhl
h6DG9y3eJb9gqL/g72m4E0wMrbLErmZdnZHY+mjJeJ/9qPmC2TbnF5TBPNmNj740
h/qI1Pvv00Hwo1HIHhuw+W7bw4kskrRz1cGqzQm26YuApnO8Zzkxe0Yg6mOlcp55
STA8/raLQOYNUCQS/cuOi7wdxQiyBOOISi3n+M0vIKvK5vSa95BpdcJEBW6AOs51
xFDOYnllXZ57MGDB3wjtDl80XXTtRpJmfG5vfeS9FSleKTPJoswhgBM3DLdx3x06
ol2gE81j9QXfRSAo5GiTzRb9IFOqzP/F4wlIMlGQ8Ss+Q/89W77miL+Q5T+b3kPz
RTF51tprPmnDMUpV1bcuD24luct0HHnbz1gJDpYa1x6t+od65gD290U2lkeQbewc
CPBcgBcN5r35BA9he9+yJxuOeh0Ic2Meyca7+I5UixuBe4dSYSRhZZYZCgnCB/G2
5Jb0oj/SWQM0huOGPm5sxfI90fNS4hdth6BwUTZ4tYQS+ETTxObJm3Yx/YxddkmD
KT2RWCnh64Uy5BQRTn0AN5yNQEqm8kR5zsA1OgDS0+7jrmOF4ydlfymqH05DuUly
aFrXL4T4GTkO3+mt4Hotrwf4zvZ9eQwAR/XQ5uU5lSgYCb0U76vyiHwG4t6qcZDl
VeSZgirBQCsr8xuw
=RMWs
—–END PGP SIGNATURE—–

_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command “unsubscribe” in the subject of your message to cust-security-announce-leave@cisco.com