PT-2020-4651 · Cisco · Cisco Sd-Wan Vmanage

Johnny Yu · Published 2020-11-04 · Updated 2025-08-04 · CVE-2020-26066

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software (affected versions not specified)

Description The issue is related to improper handling of XML External Entity (XXE) entries when parsing certain XML files in the web UI of Cisco SD-WAN vManage Software. This could allow an authenticated, remote attacker to gain read and write access to information stored on an affected system. The attacker could exploit this by persuading a user to import a crafted XML file with malicious entries, potentially allowing the attacker to read and write files within the affected application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2020-05203

CVE-2020-26066

Affected Products

Cisco Sd-Wan Vmanage

References · 8

• https://osv.dev/vulnerability/CVE-2020-26066 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx3-vrZbOqqD · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26066 · Security Note
• https://bdu.fstec.ru/vul/2020-05203 · Security Note
• https://t.me/cveNotify/130757 · Telegram Post
• https://t.me/cvedetector/11370 · Telegram Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx3-vrZbOqqD · Note
• https://twitter.com/CVEnew/status/1858552663992090739 · Twitter Post