CVE-2021-1468
published 2021-05-06CVE-2021-1468: Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.02%
78.7th percentile
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application. For more information about these vulnerabilities, see the Details section of this advisory.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | catalyst_sd-wan_manager | >= 20.4 < 20.4.1 | 20.4.1 |
| cisco | catalyst_sd-wan_manager | >= 20.5 < 20.5.1 | 20.5.1 |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | sd-wan_vmanage | < 20.3.3 | 20.3.3 |
| cisco | sd-wan_vmanage | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
57527, 57528, 57529, 57530, 57535, 57536, 57537, 57538
- →Exploit attempts involve submitting specially crafted input to the vManage service to call privileged actions and create new administrative-level accounts. ↗
- ·No workarounds are available; only vendor-supplied software updates address these vulnerabilities. ↗
- ·Multiple CWEs are associated with this CVE (improper input validation, missing authorization, incorrect authorization), indicating the attack surface spans several vulnerability classes in vManage. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_cisco9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco SD-WAN vManage Software Vulnerabilities
vendor_cisco·2021-05-05·CVSS 9.8
CVE-2021-1275 [CRITICAL] CWE-20 Cisco SD-WAN vManage Software Vulnerabilities
Cisco SD-WAN vManage Software Vulnerabilities
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application.
For more information about these vulnerabilities, see the Details section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-vmanage-4TbynnhZ
Cisco
Cisco SD-WAN vManage Software Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2021-1468 Cisco SD-WAN vManage Software Vulnerabilities
CVE-2021-1468: Cisco SD-WAN vManage Software Vulnerabilities
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application. For more information about these vulnerabilities, see the
CVSS: 3.1
CWE: CWE-20, CWE-862, CWE-863, CWE-20, CWE-862, CWE-863
Bug IDs: CSCvu28360, CSCvu28390, CSCvu28402, CSCvu28360, CSCvu28390
GHSA
GHSA-77ww-5vqp-x7vx: Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to
ghsa_unreviewed·2022-05-24
CVE-2021-1468 [CRITICAL] CWE-20 GHSA-77ww-5vqp-x7vx: Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application. For more information about these vulnerabilities, see the Details section of this advisory.
No detection rules found.
No public exploits indexed.
Talos
Threat Source Newsletter (May 13, 2021)
blogs_talos·2021-05-13
Threat Source Newsletter (May 13, 2021)
## Threat Source Newsletter (May 13, 2021)
Newsletter compiled by Jon Munshaw.
Good afternoon, Talos readers.
In case you missed the Friday news drop last week, we have an update on the Lemon Duck cryptocurrency miner. It's not as eye-catching as the ransomware attacks that make the news, but Lemon Duck's exploitation of Microsoft Exchange servers shows that patching is still king, and a cryptocurrency attack shows there's room for additional attacks in the future.
Speaking of patching, it's time to update your Microsoft products if you haven't already. This month's Patch Tuesday included a wormable vulnerability in the HTTP protocol stack that has a severity score of 9.8 out of 10. Of course, it's important to always patch any and all vulnerabilities, but that's the one that most peop
Talos
Threat Source Newsletter (May 13, 2021)
blogs_talos·2021-05-13
Threat Source Newsletter (May 13, 2021)
Newsletter compiled by Jon Munshaw.
Good afternoon, Talos readers.
In case you missed the Friday news drop last week, we have an update on the Lemon Duck cryptocurrency miner. It's not as eye-catching as the ransomware attacks that make the news, but Lemon Duck's exploitation of Microsoft Exchange servers shows that patching is still king, and a cryptocurrency attack shows there's room for additional attacks in the future.
Speaking of patching, it's time to update your Microsoft products if you haven't already. This month's Patch Tuesday included a wormable vulnerability in the HTTP protocol stack that has a severity score of 9.8 out of 10. Of course, it's important to always patch any and all vulnerabilities, but that's the one that most people came out of Tuesday talking about.
## Up
2021-05-06
Published