PT-2018-8773 · Cisco · Vbond Orchestrator+3

Published 2018-07-18 · Updated 2020-08-28 · CVE-2018-0345

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN Solution versions prior to 18.3.0 vBond Orchestrator Software versions prior to 18.3.0 vManage Network Management Software versions prior to 18.3.0 vSmart Controller Software versions prior to 18.3.0

Description A vulnerability in the configuration and management database of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary commands with the privileges of the vmanage user in the configuration management system. The issue is due to insufficient validation of command arguments passed to the configuration and management database. An attacker could exploit this by creating custom functions containing malicious code, which are executed as the vmanage user. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the vmanage user.

Recommendations For Cisco SD-WAN Solution versions prior to 18.3.0, update to Release 18.3.0 or later. For vBond Orchestrator Software versions prior to 18.3.0, update to Release 18.3.0 or later. For vManage Network Management Software versions prior to 18.3.0, update to Release 18.3.0 or later. For vSmart Controller Software versions prior to 18.3.0, update to Release 18.3.0 or later.

Fix

RCE

Argument Injection

Weakness Enumeration

CWE-20

CWE-88

Related Identifiers

CVE-2018-0345

Affected Products

Cisco Sd-Wan Solution

Vbond Orchestrator

Vmanage Network Management

Vsmart Controller

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sdwan-cx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0345 · Security Note
• http://securityfocus.com/bid/104859 · Note