CVE-2020-3378

Cisco SD-WAN vManage Software SQL Injection Vulnerability

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability in the web-based management interface for Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input that includes SQL statements to an affected system. A successful exploit could allow the attacker to modify entries in some database tables, affecting the integrity of the data.

Una vulnerabilidad en la interfaz de administración basada en web para Cisco SD-WAN vManage Software podría permitir a un atacante remoto autenticado afectar la integridad de un sistema afectado mediante una ejecución de consultas SQL arbitrarias. La vulnerabilidad es debido a una comprobación insuficiente de las entradas suministradas por el usuario. Un atacante podría explotar esta vulnerabilidad mediante el envío de entradas diseñadas que incluyen declaraciones SQL hacia un sistema afectado. Una explotación con éxito podría permitir al atacante modificar entradas en algunas tablas de la base de datos, afectando la integridad de los datos

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-12-12 CVE Reserved
2020-07-16 CVE Published
2023-03-08 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sivm-M8wugR9O	2023-05-23

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	< 18.4.5 Search vendor "Cisco" for product "Sd-wan Firmware" and version " < 18.4.5"	-	Affected	in	Cisco Search vendor "Cisco"	1100-4g Integrated Services Router Search vendor "Cisco" for product "1100-4g Integrated Services Router"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	< 18.4.5 Search vendor "Cisco" for product "Sd-wan Firmware" and version " < 18.4.5"	-	Affected	in	Cisco Search vendor "Cisco"	1100-4gltegb Integrated Services Router Search vendor "Cisco" for product "1100-4gltegb Integrated Services Router"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	< 18.4.5 Search vendor "Cisco" for product "Sd-wan Firmware" and version " < 18.4.5"	-	Affected	in	Cisco Search vendor "Cisco"	1100-4gltena Integrated Services Router Search vendor "Cisco" for product "1100-4gltena Integrated Services Router"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	< 18.4.5 Search vendor "Cisco" for product "Sd-wan Firmware" and version " < 18.4.5"	-	Affected	in	Cisco Search vendor "Cisco"	1100-6g Integrated Services Router Search vendor "Cisco" for product "1100-6g Integrated Services Router"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	< 18.4.5 Search vendor "Cisco" for product "Sd-wan Firmware" and version " < 18.4.5"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 100 Search vendor "Cisco" for product "Vedge 100"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	< 18.4.5 Search vendor "Cisco" for product "Sd-wan Firmware" and version " < 18.4.5"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 1000 Search vendor "Cisco" for product "Vedge 1000"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	< 18.4.5 Search vendor "Cisco" for product "Sd-wan Firmware" and version " < 18.4.5"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 100b Search vendor "Cisco" for product "Vedge 100b"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	< 18.4.5 Search vendor "Cisco" for product "Sd-wan Firmware" and version " < 18.4.5"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 100m Search vendor "Cisco" for product "Vedge 100m"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	< 18.4.5 Search vendor "Cisco" for product "Sd-wan Firmware" and version " < 18.4.5"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 100wm Search vendor "Cisco" for product "Vedge 100wm"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	< 18.4.5 Search vendor "Cisco" for product "Sd-wan Firmware" and version " < 18.4.5"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 2000 Search vendor "Cisco" for product "Vedge 2000"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	< 18.4.5 Search vendor "Cisco" for product "Sd-wan Firmware" and version " < 18.4.5"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 5000 Search vendor "Cisco" for product "Vedge 5000"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	>= 19.2.0 < 19.2.3 Search vendor "Cisco" for product "Sd-wan Firmware" and version " >= 19.2.0 < 19.2.3"	-	Affected	in	Cisco Search vendor "Cisco"	1100-4g Integrated Services Router Search vendor "Cisco" for product "1100-4g Integrated Services Router"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	>= 19.2.0 < 19.2.3 Search vendor "Cisco" for product "Sd-wan Firmware" and version " >= 19.2.0 < 19.2.3"	-	Affected	in	Cisco Search vendor "Cisco"	1100-4gltegb Integrated Services Router Search vendor "Cisco" for product "1100-4gltegb Integrated Services Router"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	>= 19.2.0 < 19.2.3 Search vendor "Cisco" for product "Sd-wan Firmware" and version " >= 19.2.0 < 19.2.3"	-	Affected	in	Cisco Search vendor "Cisco"	1100-4gltena Integrated Services Router Search vendor "Cisco" for product "1100-4gltena Integrated Services Router"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	>= 19.2.0 < 19.2.3 Search vendor "Cisco" for product "Sd-wan Firmware" and version " >= 19.2.0 < 19.2.3"	-	Affected	in	Cisco Search vendor "Cisco"	1100-6g Integrated Services Router Search vendor "Cisco" for product "1100-6g Integrated Services Router"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	>= 19.2.0 < 19.2.3 Search vendor "Cisco" for product "Sd-wan Firmware" and version " >= 19.2.0 < 19.2.3"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 100 Search vendor "Cisco" for product "Vedge 100"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	>= 19.2.0 < 19.2.3 Search vendor "Cisco" for product "Sd-wan Firmware" and version " >= 19.2.0 < 19.2.3"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 1000 Search vendor "Cisco" for product "Vedge 1000"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	>= 19.2.0 < 19.2.3 Search vendor "Cisco" for product "Sd-wan Firmware" and version " >= 19.2.0 < 19.2.3"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 100b Search vendor "Cisco" for product "Vedge 100b"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	>= 19.2.0 < 19.2.3 Search vendor "Cisco" for product "Sd-wan Firmware" and version " >= 19.2.0 < 19.2.3"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 100m Search vendor "Cisco" for product "Vedge 100m"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	>= 19.2.0 < 19.2.3 Search vendor "Cisco" for product "Sd-wan Firmware" and version " >= 19.2.0 < 19.2.3"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 100wm Search vendor "Cisco" for product "Vedge 100wm"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	>= 19.2.0 < 19.2.3 Search vendor "Cisco" for product "Sd-wan Firmware" and version " >= 19.2.0 < 19.2.3"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 2000 Search vendor "Cisco" for product "Vedge 2000"	-	-	Safe
Cisco Search vendor "Cisco"	Sd-wan Firmware Search vendor "Cisco" for product "Sd-wan Firmware"	>= 19.2.0 < 19.2.3 Search vendor "Cisco" for product "Sd-wan Firmware" and version " >= 19.2.0 < 19.2.3"	-	Affected	in	Cisco Search vendor "Cisco"	Vedge 5000 Search vendor "Cisco" for product "Vedge 5000"	-	-	Safe