PT-2020-1379 · Cisco · Cisco Ios Xe Sd-Wan

Published 2020-02-19 · Updated 2023-05-22 · CVE-2019-1950

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE SD-WAN Software versions 16.11 and earlier

Description A vulnerability in the software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device due to the existence of default credentials within the default configuration. An attacker who has access to an affected device could log in with elevated privileges, potentially taking complete control of the device. The issue is related to errors in handling registration data, which could be exploited to gain full control over the device.

Recommendations For versions 16.11 and earlier, consider changing the default credentials to prevent unauthorized access, and ensure that all devices are configured with secure login credentials to minimize the risk of exploitation. As a temporary workaround, restrict access to the device to prevent attackers from logging in with elevated privileges.

Fix

Weakness Enumeration

CWE-1188

CWE-255

Related Identifiers

BDU:2020-00328

CVE-2019-1950

Affected Products

Cisco Ios Xe Sd-Wan

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-cred-EVGSF259 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1950 · Security Note
• https://bdu.fstec.ru/vul/2020-00328 · Security Note
• https://t.me/cvenotify/1103 · Telegram Post