CVE-2019-1624CWE-77

Cisco SD-WAN Solution Command Injection Vulnerability

High · published June 20, 2019

CVSS v3.0
8.8
EPSS
4%
Percentile
91.0
In the wild
Unconfirmed
What it is

A vulnerability in the vManage web-based UI (Web UI) in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the vManage Web UI. A successful exploit could allow the attacker to execute commands with root privileges.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04255 · 91.0th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2019-06-20T02:45Z
EPSS history
Timeline
  • 20 JUN 02:45Z
    Cisco SD-WAN Solution Command Injection Vulnerability
    cvelistv5