Cisco SD-WAN Software Privilege Escalation (cisco-sa-vepestd-8C3J9Vc)

high Nessus Plugin ID 142995

Language:

Synopsis

The remote device is missing a vendor-supplied security patch

Description

According to its self-reported version, Cisco SD-WAN is affected by a privilege escalation vulnerability exists due to insufficient input validation. An authenticated, local attacker can exploit this by sending crafted options to a specific command, to gain root access to the system.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvv42376

Plugin Details

Severity: High

ID: 142995

File Name: cisco-sa-vepestd-8C3J9Vc.nasl

Version: 1.6

Type: local

Family: CISCO

Published: 11/18/2020

Updated: 11/24/2020

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2020-3594

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:cisco:sd-wan_firmware

Required KB Items: Cisco/Viptela/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 11/4/2020

Vulnerability Publication Date: 11/4/2020

Reference Information

CVE: CVE-2020-3594

CWE: 269

CISCO-SA: cisco-sa-vepestd-8C3J9Vc

IAVA: 2020-A-0509

CISCO-BUG-ID: CSCvv42376

Detections

Analytics