CVE-2021-1225

published 2021-01-20

CVE-2021-1225: Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct SQL…

critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I H A N

Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities exist because the web-based management interface improperly validates values in SQL queries. An attacker could exploit these vulnerabilities by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on or return values from the underlying database or the operating system.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_sd-wan_vmanage	—	—
cisco	sd-wan_vmanage	< 19.2.3	19.2.3
cisco	sd-wan_vmanage	—	—

CWE-89