Cisco Multiple Vulnerabilities

THE THREAT

On April 7th, 2021, Cisco announced two high rated and one critical vulnerability impacting the Cisco SD-WAN vManage Software. vManage software is used to centralize network management.

CVE-2021-1137 and CVE-2021-1480 (CVSS:7.8) are Privilege Escalation vulnerabilities that could be used by a previously authenticated actor to gain root privileges on the underlying operating system. More concerning is CVE-2021-1479 (CVSS:9.8); a Buffer Overflow vulnerability that allows an unauthenticated remote actor to execute code with root privileges on the underlying operating system.

While exploitation in the wild has not been identified at this time, the high criticality rating for CVE-2021-1479 is likely to draw attention from both researchers and threat actors. Organizations are strongly recommended to apply the relevant security patches as soon as possible.

What we’re doing about it

• MVS will automatically add the relevant plugins for these vulnerabilities once details are made available
• eSentire security teams continue to track this topic and additional detection measures are currently under review

What you should do about it

• After performing a business impact review, apply the relevant security patches provided by Cisco
  • There are currently no workarounds to mitigate these vulnerabilities

Additional information

CVE-2021-1479 (CVSS: 9.8) Cisco SD-WAN vManage Remote Management Buffer Overflow Vulnerability

• An unauthenticated, remote attacker could exploit this vulnerability to cause a buffer overflow condition
• A successful exploit would allow for arbitrary code execution on the underlying operating system with root privileges

CVE-2021-1137 & CVE-2021-1480 (CVSS: 7.8) Cisco SD-WAN vManage Privilege Escalation Vulnerability

• The vulnerabilities could allow an authenticated local attacker to escalate privileges on the underlying operating system to root level

Impacted Cisco SD-WAN vManage Versions:

• 18.4 and earlier
• 19.2
• 19.3
• 20.1
• 20.3
• 20.4

References:

[1] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-YuTVWqy
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-1137
[3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=-2021-1480
[4] https://cve.mitre.org/cgi-bin/cvename.cgi?name=-2021-1479