PT-2020-3113 · Cisco · Cisco Sd-Wan Vmanage

Johnny Yu · Published 2020-07-15 · Updated 2023-05-23 · CVE-2020-3387

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software (affected versions not specified)

Description The issue is due to insufficient input sanitization during user authentication processing, allowing an authenticated, remote attacker to execute code with root privileges on an affected system. An attacker could exploit this by sending a crafted response to the Cisco SD-WAN vManage Software, potentially accessing the software and executing unauthorized commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-03405

CVE-2020-3387

Affected Products

Cisco Sd-Wan Vmanage

References · 6

• 🔥 http://packetstormsecurity.com/files/162958/Cisco-SD-WAN-vManage-19.2.2-Remote-Root.html · Exploit
• https://bdu.fstec.ru/vul/2020-03405 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanrce-4jtWT28P · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3387 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3387 · Security Note
• https://t.me/cvenotify/18809 · Telegram Post