CVE-2019-12629

A vulnerability in the WebUI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system. The vulnerability is due to insufficient input validation of data parameters for certain fields in the affected solution. An attacker could exploit this vulnerability by configuring a malicious username on the login page of the affected solution. A successful exploit could allow the attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system.

CVSS v3 7.2 HIGH
CVSS v2.0 9.0 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-sdwan-cmd-inject	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:cisco:sd-wan_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:cisco:vedge-100:-:::::::*
	cpe:2.3:h:cisco:vedge-1000:-:::::::*
	cpe:2.3:h:cisco:vedge-100b:-:::::::*
	cpe:2.3:h:cisco:vedge-2000:-:::::::*
	cpe:2.3:h:cisco:vedge-5000:-:::::::*
	cpe:2.3:h:cisco:vedge_100m:-:::::::*
	cpe:2.3:h:cisco:vedge_100wm:-:::::::*

History

No history.

Information

Published : 2020-01-26 05:15

Updated : 2024-02-28 17:28

NVD link : CVE-2019-12629

Mitre link : CVE-2019-12629

CVE.ORG link : CVE-2019-12629

JSON object : View

Products Affected

cisco

vedge-100
vedge-100b
vedge_100m
sd-wan_firmware
vedge-2000
vedge_100wm
vedge-1000
vedge-5000

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2019-12629", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.2}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2020-01-26T05:15:11.083", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-sdwan-cmd-inject", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the WebUI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system. The vulnerability is due to insufficient input validation of data parameters for certain fields in the affected solution. An attacker could exploit this vulnerability by configuring a malicious username on the login page of the affected solution. A successful exploit could allow the attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system."}, {"lang": "es", "value": "Una vulnerabilidad en la WebUI del Cisco SD-WAN Solution, podr\u00eda permitir a un atacante remoto autenticado inyectar y ejecutar comandos arbitrarios con privilegios de usuario vmanage en un sistema afectado. La vulnerabilidad es debido a una comprobaci\u00f3n de entrada insuficiente de los par\u00e1metros de datos para determinados campos en la soluci\u00f3n afectada. Un atacante podr\u00eda explotar esta vulnerabilidad mediante la configuraci\u00f3n de un nombre de usuario malicioso en la p\u00e1gina de inicio de sesi\u00f3n de la soluci\u00f3n afectada. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante inyectar y ejecutar comandos arbitrarios con privilegios de usuario vmanage en un sistema afectado."}], "lastModified": "2020-10-08T14:39:47.400", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "484C01EF-C2DE-43DB-8C3F-C2C013A182FE", "versionEndExcluding": "18.3.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:vedge-100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5D71E4AF-6E91-4493-A591-4D056D0E59C1"}, {"criteria": "cpe:2.3:h:cisco:vedge-1000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F718A859-BCDB-4DD0-819D-60ABE710F0A9"}, {"criteria": "cpe:2.3:h:cisco:vedge-100b:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "07E7851F-3E72-4677-B907-CF777EBED2FF"}, {"criteria": "cpe:2.3:h:cisco:vedge-2000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "52EEF288-492C-4CE6-A082-631005C5E711"}, {"criteria": "cpe:2.3:h:cisco:vedge-5000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C0C5E2C9-7D4B-405C-93DD-33DF265131E2"}, {"criteria": "cpe:2.3:h:cisco:vedge_100m:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "36973815-F46D-4ADA-B9DF-BCB70AC60BD3"}, {"criteria": "cpe:2.3:h:cisco:vedge_100wm:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "061A302C-8D35-4E80-93DA-916DA7E90C06"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}