Black Arrow Cyber Advisory 17 July 2023 – Cisco SD-WAN vManage Vulnerable to Remote Unauthenticated Access
Executive Summary
A critical vulnerability has been identified and addressed in Cisco's network management software, SD-WAN vManage. The vulnerability allows a remote unauthenticated attacker to gain read or limited write permissions to the configuration of an affected Cisco SD-WAN vManage instance. This vulnerability only affects the REST API and does not affect the web-based management interface or the command line interface.
What’s the risk to me or my business?
A successful exploitation of the critical vulnerability allows a remote unauthenticated threat actor to read sensitive information from the compromised system, modify certain configurations, disrupt network operations. This will compromise the confidentiality, integrity, and availability of data in your organisation.
The following Cisco SD-WAN vManage versions are affected by the vulnerability:
v20.6.3.3 – fixed in v20.6.3.4
v20.6.4 – fixed in v20.6.4.2
v20.6.5 – fixed in v20.6.5.5
v20.7 – Migrate to fixed version v20.8 – Migrate to fixed version
v20.9 – fixed in v20.9.3.2
v20.10 – fixed in v20.10.1.2
v20.11 – fixed in v20.11.1.2
What can I do?
There are no workarounds for the critical vulnerability. As such, it is advised that patches are applied immediately. For versions v20.7 and v20.8, Cisco advises customers to migrate to a fixed release. Cisco has given advice on how to reduce the attack surface for this attack, this includes actions such as monitoring logs for the REST API and limiting instances to specified instances. If you are unsure check with your MSP or network team to ensure these are in place.
More information on the Cisco SD-WAN vManage vulnerability can be found here:
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity