CVE-2019-16012 — Command Injection in Cisco Sd-wan Firmware

CWE-77 — Command InjectionCWE-89 — SQL Injection4 documents4 sources
Severity
8.1HIGHNVD
EPSS
7.2%
top 8.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Sd-wan FirmwareCisco Vmanage Software
Timeline
PublishedMar 19
Latest updateMay 24

Description

A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on, or return values from, the underlying datab…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶NVDcisco/sd-wan_firmware< 19.2.2

🔴Vulnerability Details

2
GHSA
GHSA-2c85-mrfp-x4x7: A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks↗2022-05-24
▶
CVEList
Cisco SD-WAN Solution vManage SQL Injection Vulnerability↗2020-03-19
▶

📋Vendor Advisories

1
Cisco
Cisco SD-WAN Solution vManage SQL Injection Vulnerability↗2020-03-18
▶
CVE-2019-16012 — Command Injection in Cisco | cvebase