CVE-2020-3374, CVE-2020-3375: CISCO SD-WAN High-Risk Vulnerabilities Alert

by ·

Recently, Cisco (Cisco) officially released an announcement stating that it has repaired two high-risk vulnerabilities in Cisco SD-WAN vManager Software (CVE-2020-3374) and SD-WAN Solution Software (CVE-2020-3375).
Cisco SD-WAN is a secure cloud-scale architecture with openness, programmability, and scalability. Through the Cisco vManage console, you can quickly establish SD-WAN coverage structures to connect data centers, branch offices, campuses, and colocation facilities to improve network speed, security, and efficiency.

Vulnerability Detail

1. CVE-2020-3374

Vulnerabilities in the Cisco SD-WAN vManage software web-based management interface could allow authenticated remote attackers to bypass authorization, allowing them to access sensitive information, modify system configurations, or affect the availability of affected systems.

Base 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:X

Affected product

  • All products using SD-WAN vManager Software

2. CVE-2020-3375

A vulnerability in the Cisco SD-WAN solution software could allow an unauthenticated remote attacker to cause a buffer overflow on the affected device.
The vulnerability is caused by insufficient input validation. An attacker can exploit this vulnerability by sending specially crafted traffic to the affected device. Successful exploitation of this vulnerability may allow an attacker to gain access to the device, change the system’s permissions, and execute commands on the affected system with root permissions.

Base 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X

Affected product

  • IOS XE SD-WAN Software
  • SD-WAN vBond Orchestrator Software
  • SD-WAN vEdge Cloud Routers
  • SD-WAN vEdge Routers
  • SD-WAN vManage Software
  • SD-WAN vSmart Controller Software

Solution

Cisco has officially released a new version to fix these vulnerabilities. Users are requested to upgrade as soon as possible for protection.

Tags: