PT-2020-4652 · Cisco · Cisco Sd-Wan Vmanage

Johnny Yu · Published 2020-11-04 · Updated 2024-01-25 · CVE-2020-26064

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software (affected versions not specified)

Description The issue is related to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this by persuading a user to import a crafted XML file with malicious entries, potentially gaining read and write access to information stored on the affected system. This could allow the attacker to read and write files within the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2020-05204

CVE-2020-26064

Affected Products

Cisco Sd-Wan Vmanage

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-26064 · Security Note
• https://bdu.fstec.ru/vul/2020-05204 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26064 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx2-KpFVSUc · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx2-KpFVSUc · Note
• https://t.me/cvenotify/56170 · Telegram Post
• https://t.me/cibsecurity/67807 · Telegram Post
• https://t.me/cvenotify/59532 · Telegram Post