PT-2021-5380 · Cisco · Cisco Sd-Wan Vmanage

Published 2021-09-22 · Updated 2022-10-21 · CVE-2021-1589

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software (affected versions not specified)

Description The issue is related to insufficient protection of registration data in the disaster recovery feature of Cisco SD-WAN vManage Software. This could allow a remote attacker to gain unauthorized access to user credentials by sending a specially crafted request to an API endpoint, such as "/api/v1/login" or "/users/{id}". The vulnerability exists because access to API endpoints is not properly restricted, potentially allowing an attacker to exploit it and gain access to administrative credentials.

Recommendations For Cisco SD-WAN vManage Software, consider restricting access to API endpoints until a patch is available. As a temporary workaround, avoid using sensitive username and password variables in affected API endpoints. Restrict access to administrative credentials to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

BDU:2021-06216

CVE-2021-1589

Affected Products

Cisco Sd-Wan Vmanage

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-1589 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-credentials-ydYfskzZ · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06216 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1589 · Vendor Advisory
• https://t.me/cibsecurity/29267 · Telegram Post