PT-2020-4645 · Cisco · Cisco Sd-Wan Vmanage

Yaar Hahn · Published 2020-11-04 · Updated 2025-08-04 · CVE-2020-26073

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software (affected versions not specified)

Description The issue is related to improper validation of directory traversal character sequences within requests to application programmatic interfaces (APIs). This could allow an unauthenticated, remote attacker to gain access to sensitive information, including credentials or user tokens, by conducting directory traversal attacks. The attacker could exploit this by sending malicious requests to an API within the affected application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-35

Related Identifiers

BDU:2020-05197

CVE-2020-26073

Affected Products

Cisco Sd-Wan Vmanage

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2020-26073 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-traversal-hQh24tmk · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-dos-7uZWwSEy · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-escalation-Jhqs5Skf · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05197 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26073 · Vendor Advisory
• https://t.me/cveNotify/130769 · Telegram Post
• https://twitter.com/CVEnew/status/1858546013616644494 · Twitter Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-traversal-hQh24tmk · Note