The first of these vulnerabilities is a command injection vulnerability (CVE-2020-3266) with a CVSS score of 7.8. As elaborated in an advisory, a local attacker could exploit the bug to inject and execute arbitrary commands with root privileges.
Explaining further about the flaw, the advisory reads,
The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility.The second high-risk vulnerability (CVE-2020-3264) also existed due to insufficient input validation that could cause a buffer overflow on the target device. As explained in the advisory,
An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to information that they are not authorized to access and make changes to the system that they are not authorized to make.Whereas, the third similar vulnerability (CVE-2020-3265) could allow a local adversary to gain root privileges. Exploiting the bug simply required an attacker to send a maliciously crafted request to a target system.
Upon detecting the bugs, Cisco patched them with the release of Cisco SD-WAN Solution software Release 19.2.2. Users of the respective devices must ensure that their systems are running on the latest version with the fixes.
Cisco acknowledged the Orange Group for reporting all these vulnerabilities. Whereas they also confirmed no detection of active exploitation of the bugs.
Let us know your thoughts in the comments.
