Cisco SD-WAN vManage Web-based Management Interface HTTP Requests resource consumption

Summaryinfo

A vulnerability described as problematic has been identified in Cisco SD-WAN vManage. This affects an unknown function of the component Web-based Management Interface. Executing a manipulation as part of HTTP Requests can lead to resource consumption. This vulnerability is handled as CVE-2020-3372. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in Cisco SD-WAN vManage (unknown version). This vulnerability affects an unknown code block of the component Web-based Management Interface. The manipulation as part of a HTTP Requests leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to consume excessive system memory and cause a denial of service (DoS) condition on an affected system. The vulnerability is due to inefficient memory management. An attacker could exploit this vulnerability by sending a large number of crafted HTTP requests to the affected web-based management interface. A successful exploit could allow the attacker to exhaust system memory, which could cause the system to stop processing new connections and could result in a DoS condition.

The weakness was released 07/16/2020 as cisco-sa-emvman-3y6LuTcZ as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability was named CVE-2020-3372 since 12/12/2019. The attack can be initiated remotely. The requirement for exploitation is a single authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-158720 and VDB-158717. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Network Management Software

Vendor

• Cisco

Name

• SD-WAN vManage

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion