Cisco SD-WAN Solution up to 18.2.x CLI LOAD Command command injection

Summaryinfo

A vulnerability identified as critical has been detected in Cisco SD-WAN Solution up to 18.2.x. This affects an unknown function of the component CLI. This manipulation as part of LOAD Command causes command injection. This vulnerability is handled as CVE-2018-0348. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco SD-WAN Solution up to 18.2.x (Network Management Software). It has been declared as critical. Affected by this vulnerability is some unknown functionality of the component CLI. The manipulation as part of a LOAD Command leads to a command injection vulnerability. The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the CLI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting malicious input to the load command within the VPN subsystem. The attacker must be authenticated to access the affected CLI parameter. A successful exploit could allow an attacker to execute commands with root privileges. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vEdge 100 Series Routers, vEdge 1000 Series Routers, vEdge 2000 Series Routers, vEdge 5000 Series Routers, vEdge Cloud Router Platform, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi69866.

The bug was discovered 07/18/2018. The weakness was released 07/18/2018 with Cisco as cisco-sa-20180718-sdwan-cmdnjc as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2018-0348 since 11/27/2017. The attack can be launched remotely. A single authentication is required for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading to version 18.3.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 104875†). Entries connected to this vulnerability are available at VDB-121924, VDB-121923, VDB-121922 and VDB-121920. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Network Management Software

Vendor

• Cisco

Name

• SD-WAN Solution

Version

• 18.0
• 18.1
• 18.2

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion