PT-2018-8778 · Cisco · Vbond Orchestrator+8

Published 2018-07-18 · Updated 2019-10-09 · CVE-2018-0350

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN Solution versions prior to 18.3.0 vBond Orchestrator Software versions prior to 18.3.0 vEdge 100 Series Routers versions prior to 18.3.0 vEdge 1000 Series Routers versions prior to 18.3.0 vEdge 2000 Series Routers versions prior to 18.3.0 vEdge 5000 Series Routers versions prior to 18.3.0 vEdge Cloud Router Platform versions prior to 18.3.0 vManage Network Management Software versions prior to 18.3.0 vSmart Controller Software versions prior to 18.3.0

Description A vulnerability in the VPN subsystem configuration could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges due to insufficient input validation. The attacker must be authenticated to access the affected parameter and could exploit this vulnerability by submitting crafted input to the affected parameter in a web page. A successful exploit could allow the attacker to execute commands with root privileges.

Recommendations For Cisco SD-WAN Solution version prior to 18.3.0, update to Release 18.3.0 or later. For vBond Orchestrator Software version prior to 18.3.0, update to Release 18.3.0 or later. For vEdge 100 Series Routers version prior to 18.3.0, update to Release 18.3.0 or later. For vEdge 1000 Series Routers version prior to 18.3.0, update to Release 18.3.0 or later. For vEdge 2000 Series Routers version prior to 18.3.0, update to Release 18.3.0 or later. For vEdge 5000 Series Routers version prior to 18.3.0, update to Release 18.3.0 or later. For vEdge Cloud Router Platform version prior to 18.3.0, update to Release 18.3.0 or later. For vManage Network Management Software version prior to 18.3.0, update to Release 18.3.0 or later. For vSmart Controller Software version prior to 18.3.0, update to Release 18.3.0 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2018-0350

Affected Products

Cisco Sd-Wan Solution

Vbond Orchestrator

Vedge 100 Series Routers

Vedge 1000 Series Routers

Vedge 2000 Series Routers

Vedge 5000 Series Routers

Vedge Cloud Router Platform

Vmanage Network Management

Vsmart Controller

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-0350 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0350 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sdwan-cmdinj · Vendor Advisory
• http://securityfocus.com/bid/104874 · Note