CVSS: 8.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-20739 – Cisco SD-WAN vManage Software Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-20739
A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the root user. The attacker must be authenticated on the affected system as a low-privileged user to exploit this vulnerability. This vulnerability exists because a file leveraged by a root user is executed when a low-privileged user runs specific commands on an affected system. An attacker could exploit this vulnerability by injecting arbitrary commands to a specific file as a lower-privileged user and then waiting until an admin user executes specific commands. The commands would then be executed on the device by the root user. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-vman-tEJFpBSL • CWE-269: Improper Privilege Management •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-20747 – Cisco SD-WAN vManage Software Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-20747
A vulnerability in the History API of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected system. This vulnerability is due to insufficient API authorization checking on the underlying operating system. An attacker could exploit this vulnerability by sending a crafted API request to Cisco vManage as a lower-privileged user and gaining access to sensitive information that they would not normally be authorized to access. Una vulnerabilidad en la API del historial del software Cisco SD-WAN vManage podría permitir a un atacante remoto autenticado acceder a información confidencial en un sistema afectado. Esta vulnerabilidad es debido a una comprobación insuficiente de la autorización de la API en el sistema operativo subyacente. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-infodis-73sHJNEq • CWE-202: Exposure of Sensitive Information Through Data Queries •
CVSS: 5.5EPSS: 0%CPEs: 42EXPL: 0CVE-2021-1546 – Cisco SD-WAN Software Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-1546
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to improper protections on file access through the CLI. An attacker could exploit this vulnerability by running a CLI command that targets an arbitrary file on the local system. A successful exploit could allow the attacker to return portions of an arbitrary file, possibly resulting in the disclosure of sensitive information. Una vulnerabilidad en la CLI de Cisco SD-WAN Software podría permitir a un atacante local autenticado acceder a información confidencial. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-Fhqh8pKX • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-34712 – Cisco SD-WAN vManage Software Cypher Query Language Injection Vulnerability
https://notcve.org/view.php?id=CVE-2021-34712
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct cypher query language injection attacks on an affected system. This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the interface of an affected system. A successful exploit could allow the attacker to obtain sensitive information. Una vulnerabilidad en la interfaz de administración basada en la web de Cisco SD-WAN vManage Software podría permitir a un atacante remoto autenticado realizar ataques de inyección de lenguaje de consulta cifrado en un sistema afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-jOsuRJCc • CWE-943: Improper Neutralization of Special Elements in Data Query Logic •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-34700 – Cisco SD-WAN vManage Software Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-34700
A vulnerability in the CLI interface of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read arbitrary files on the underlying file system of an affected system. This vulnerability exists because access to sensitive information on an affected system is not sufficiently controlled. An attacker could exploit this vulnerability by gaining unauthorized access to sensitive information on an affected system. A successful exploit could allow the attacker to create forged authentication requests and gain unauthorized access to the web UI of an affected system. Una vulnerabilidad en la interfaz CLI del software Cisco SD-WAN vManage podría permitir a un atacante local autenticado leer archivos arbitrarios en el sistema de archivos subyacente de un sistema afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vmanage-infdis-LggOP9sE • CWE-522: Insufficiently Protected Credentials •