A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to gain read permissions or limited write permissions to the configuration of an affected Cisco SD-WAN vManage instance. This vulnerability is due to insufficient request validation when using the REST API feature. An attacker could exploit this vulnerability by sending a crafted API request to an affected vManage instance. A successful exploit could allow the attacker to retrieve information from and send information to the configuration of the affected Cisco vManage instance. This vulnerability only affects the REST API and does not affect the web-based management interface or the CLI.

Published 2023-08-03 · Modified

9.1EPSS 0.009

CVE-2021-1284

Cisco SD-WAN vManage Software Authentication Bypass Vulnerability

Published 2021-05-06 · Modified

8.8EPSS 0.004

CVE-2022-20696

Cisco SD-WAN vManage Software Unauthenticated Access to Messaging Services Vulnerability

Published 2022-09-08 · Modified

8.8EPSS 0.004

CVE-2022-20739

Cisco SD-WAN vManage Software Privilege Escalation Vulnerability

Published 2022-04-15 · Modified

8.5EPSS 0.006

CVE-2021-1480

Cisco SD-WAN vManage Software Vulnerabilities

Published 2021-04-08 · Modified

7.8EPSS 0.018

CVE-2022-20818

Cisco SD-WAN Software Privilege Escalation Vulnerabilities

Published 2022-09-30 · Modified

7.8EPSS 0.006

CVE-2021-1137

Cisco SD-WAN vManage Software Vulnerabilities

Published 2021-04-08 · Modified

7.8EPSS 0.006

CVE-2021-1514

Cisco SD-WAN Software Privilege Escalation Vulnerability

Published 2021-05-06 · Modified

7.8EPSS 0.003

CVE-2023-20262

A vulnerability in the SSH service of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to cause a process crash, resulting in a DoS condition for SSH access only. This vulnerability does not prevent the system from continuing to function, and web UI access is not affected. This vulnerability is due to insufficient resource management when an affected system is in an error condition. An attacker could exploit this vulnerability by sending malicious traffic to the affected system. A successful exploit could allow the attacker to cause the SSH process to crash and restart, resulting in a DoS condition for the SSH service.

Published 2023-09-27 · Modified

7.5EPSS 0.007

CVE-2020-27129

Cisco SD-WAN vManage Software Command Injection Vulnerability

Published 2020-11-06 · Modified

7.2EPSS 0.003

CVE-2022-20850

Cisco SD-WAN Arbitrary File Deletion Vulnerability

Published 2022-09-30 · Modified

7.1EPSS 0.002

CVE-2023-20253

A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass authorization and allow the attacker to roll back the configuration on vManage controllers and edge router device. This vulnerability is due to improper access control in the cli-management interface of an affected system. An attacker with low-privilege (read only) access to the cli could exploit this vulnerability by sending a request to roll back the configuration on for other controller and devices managed by an affected system. A successful exploit could allow the attacker to to roll back the configuration on for other controller and devices managed by an affected system.

Published 2023-09-27 · Modified

7.1EPSS 0.002

CVE-2021-1259

Cisco SD-WAN vManage Software Path Traversal Vulnerability

Published 2021-01-20 · Modified

6.8EPSS 0.019

CVE-2022-20930

Cisco SD-WAN Software Arbitrary File Corruption Vulnerability

Published 2022-09-30 · Modified

6.7EPSS 0.002

CVE-2021-1349

Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability

Published 2021-01-20 · Modified

6.5EPSS 0.014

CVE-2022-20747

Cisco SD-WAN vManage Software Information Disclosure Vulnerability

Published 2022-04-15 · Modified

6.5EPSS 0.009

CVE-2020-3592

Cisco SD-WAN vManage Software Authorization Bypass Vulnerability

Published 2020-11-06 · Modified

6.5EPSS 0.008

CVE-2021-34712

Cisco SD-WAN vManage Software Cypher Query Language Injection Vulnerability

Published 2021-09-23 · Modified

6.5EPSS 0.007

CVE-2022-20735

Cisco SD-WAN vManage Software Cross-Site Request Forgery Vulnerability

Published 2022-04-15 · Modified

6.5EPSS 0.005

CVE-2020-3590

Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability

Published 2020-11-06 · Modified

6.4EPSS 0.006

CVE-2020-3587

Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability

Published 2020-11-06 · Modified

6.4EPSS 0.006

CVE-2021-1507

Cisco SD-WAN vManage API Stored Cross-Site Scripting Vulnerability

Published 2021-05-06 · Modified

6.4EPSS 0.006

CVE-2020-3579

Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability

Published 2020-11-06 · Modified

6.1EPSS 0.008

CVE-2023-20098

A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could exploit this vulnerability by running a system command containing directory traversal character sequences to target an arbitrary file. A successful exploit could allow the attacker to delete arbitrary files from the system, including files owned by root.

Published 2023-05-09 · Modified

6.0EPSS 0.005

CVE-2021-1512

Cisco SD-WAN Software Arbitrary File Corruption Vulnerability

Published 2021-05-06 · Modified

6.0EPSS 0.002

CVE-2021-1235

Cisco SD-WAN vManage Information Disclosure Vulnerability

Published 2021-01-20 · Modified

5.5EPSS 0.003

CVE-2021-34700

Cisco SD-WAN vManage Software Information Disclosure Vulnerability

Published 2021-07-22 · Modified

5.5EPSS 0.003

CVE-2021-1546

Cisco SD-WAN Software Information Disclosure Vulnerability

Published 2021-09-23 · Modified

5.5EPSS 0.002

CVE-2023-20179

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied data in element fields. An attacker could exploit this vulnerability by submitting malicious content within requests and persuading a user to view a page that contains injected content. A successful exploit could allow the attacker to modify pages within the web-based management interface, possibly leading to further browser-based attacks against users of the application.

Published 2023-09-27 · Modified

5.4EPSS 0.004

CVE-2021-1486

Cisco SD-WAN vManage HTTP Authentication User Enumeration Vulnerability

Published 2021-05-06 · Modified

5.3EPSS 0.012

CVE-2021-1535

Cisco SD-WAN vManage Information Disclosure Vulnerability

Published 2021-05-06 · Modified

5.3EPSS 0.012

CVE-2022-20830

Cisco Software-Defined Application Visibility and Control on Cisco vManage Authentication Bypass Vulnerability