PT-2020-4642 · Cisco · Cisco Sd-Wan

Published 2020-11-04 · Updated 2025-08-04 · CVE-2020-26071

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN Software (affected versions not specified)

Description The issue is related to the command-line interface (CLI) of Cisco SD-WAN Software, where insufficient input validation for specific commands could allow an authenticated, local attacker to create or overwrite arbitrary files on an affected device. This could result in a denial of service (DoS) condition. The vulnerability is due to incorrect restriction of the directory path name.

Recommendations For Cisco SD-WAN Software, update to a version that includes the fix for this issue, as software updates have been released by Cisco to address this vulnerability. At the moment, there is no information about specific versions that contain a fix for this vulnerability, but applying the latest software updates from Cisco is recommended.

Fix

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2020-05194

CVE-2020-26071

Affected Products

Cisco Sd-Wan

References · 8

• https://bdu.fstec.ru/vul/2020-05194 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vsoln-arbfile-gtsEYxns · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26071 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26071 · Vendor Advisory
• https://twitter.com/CVEnew/status/1858546006217892098 · Twitter Post
• https://twitter.com/SecuriTricks/status/1858575473690681653 · Twitter Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vsoln-arbfile-gtsEYxns · Note
• https://t.me/cveNotify/130768 · Telegram Post