CVE-2018-15387 — Improper Input Validation in Cisco Sd-wan

CWE-20 — Improper Input ValidationCWE-295 — Improper Certificate Validation4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.2%
top 63.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Sd-wanCisco Sd-wan Solution
Timeline
PublishedOct 5
Latest updateMay 13

Description

A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device. The vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by supplying a system image signed with a crafted certificate to an affected device, bypassing the certificate validation. An exploit could allow an attacker to deploy a crafted system image.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/sd-wan17.2.0 — 17.2.8+1

🔴Vulnerability Details

2
GHSA
GHSA-jhq5-xcpf-vrwm: A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device↗2022-05-13
▶
CVEList
Cisco SD-WAN Solution Certificate Validation Bypass Vulnerability↗2018-10-05
▶

📋Vendor Advisories

1
Cisco
Cisco SD-WAN Solution Certificate Validation Bypass Vulnerability↗2018-10-03
▶
CVE-2018-15387 — Improper Input Validation in Cisco | cvebase