CVE-2019-12629

A vulnerability in the WebUI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system. The vulnerability is due to insufficient input validation of data parameters for certain fields in the affected solution. An attacker could exploit this vulnerability by configuring a malicious username on the login page of the affected solution. A successful exploit could allow the attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:cisco:sd-wan_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:vedge-100:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge-1000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge-100b:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge-2000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge-5000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_100m:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_100wm:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:23

Type Values Removed Values Added
References () https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-sdwan-cmd-inject - Vendor Advisory () https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-sdwan-cmd-inject - Vendor Advisory

Information

Published : 2020-01-26 05:15

Updated : 2024-11-21 04:23


NVD link : CVE-2019-12629

Mitre link : CVE-2019-12629

CVE.ORG link : CVE-2019-12629


JSON object : View

Products Affected

cisco

  • vedge-2000
  • vedge-1000
  • vedge-100b
  • vedge-5000
  • vedge_100wm
  • vedge_100m
  • vedge-100
  • sd-wan_firmware
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')