PT-2019-2440 · Cisco · Cisco Sd-Wan Solution Vmanage

Published 2019-06-19 · Updated 2020-10-06 · CVE-2019-1626

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN Solution vManage (affected versions not specified)

Description A vulnerability in the vManage web-based UI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an affected vManage device. The issue is due to a failure to properly authorize certain user actions in the device configuration. An attacker could exploit this by logging in to the vManage Web UI and sending crafted HTTP requests to vManage, potentially allowing them to make unauthorized changes to the configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-264

Related Identifiers

BDU:2019-02218

CVE-2019-1626

Affected Products

Cisco Sd-Wan Solution Vmanage

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-1626 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-sdwan-privilescal · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02218 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1626 · Vendor Advisory
• http://securityfocus.com/bid/108838 · Note
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&last_published=2019+Jun&sort=-day_sir&limit=50#~Vulnerabilities · Note
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&last_published=2019+Jun&sort=-day_sir&limit=50#~Vulnerabilities · Note