CVE-2020-3379

Published: Jul 16, 2020Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A vulnerability in Cisco SD-WAN Solution Software could allow an authenticated, local attacker to elevate privileges to Administrator on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain administrative privileges.

Affected (3)

Products: Cisco: Sd Wan Firmware, Vbond Orchestrator, Vsmart Controller

3 products

Configuration A

1 vulnerable · 7 platform

Vulnerable Software	Affected Versions
Cisco Sd Wan Firmware	Before 18.3.0

Running on/with	Platform Versions
Cisco Vedge 100	All versions
Cisco Vedge 1000	All versions
Cisco Vedge 100b	All versions
Cisco Vedge 100m	All versions
Cisco Vedge 100wm	All versions
Cisco Vedge 2000	All versions
Cisco Vedge 5000	All versions

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Cisco Vbond Orchestrator	All versions
Cisco Vsmart Controller	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-264

References (2)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmpresc-SyzcS4kC

Source: psirt@cisco.com

Vendor Advisory

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmpresc-SyzcS4kC

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.