Cisco SD-WAN Solution CLI command injection

Summaryinfo

A vulnerability categorized as critical has been discovered in Cisco SD-WAN Solution. This issue affects some unknown processing of the component CLI. Such manipulation leads to command injection. This vulnerability is uniquely identified as CVE-2018-0433. Local access is required to approach this attack. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Cisco SD-WAN Solution (Network Management Software) (affected version unknown). Affected by this issue is an unknown functionality of the component CLI. The manipulation with an unknown input leads to a command injection vulnerability. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the command-line interface (CLI) in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. A successful exploit could allow the attacker to execute commands with root privileges.

The bug was discovered 09/05/2018. The weakness was disclosed 10/05/2018 with Cisco as cisco-sa-20180905-sd-wan-injec as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is handled as CVE-2018-0433 since 11/26/2017. The attack needs to be approached locally. The successful exploitation needs a simple authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1202.

The vulnerability was handled as a non-public zero-day exploit for at least 30 days. During that time the estimated underground price was around $5k-$25k.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 105295†). The entries VDB-124833 and VDB-124831 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Network Management Software

Vendor

• Cisco

Name

• SD-WAN Solution

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion