PT-2020-2125 · Cisco · Cisco Sd-Wan Solution Vmanage

Published 2020-03-19 · Updated 2023-05-23 · CVE-2019-16012

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN Solution vManage software (affected versions not specified)

Description The issue is related to a lack of protection against SQL query structure attacks in the vManage web interface of Cisco SD-WAN. This could allow a remote attacker to execute arbitrary SQL queries. The vulnerability exists due to improper validation of SQL values in the web UI. An attacker could exploit this by authenticating to the application and sending malicious SQL queries, potentially modifying or returning values from the underlying database and operating system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Command Injection

Weakness Enumeration

CWE-89

CWE-77

Related Identifiers

BDU:2020-02014

CVE-2019-16012

Affected Products

Cisco Sd-Wan Solution Vmanage

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200318-vmanage-cypher-inject · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16012 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16012 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02014 · Security Note