Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability in Cisco Catalyst SD-WAN products allows an unauthenticated remote attacker to bypass authentication and gain administrative control. This means an attacker could potentially take over your network management system without needing any credentials, leading to significant disruption.
- Control over network configuration is at risk.
- An attacker could compromise the entire SD-WAN fabric.
- This issue requires immediate attention due to its severity.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this by sending crafted requests to the Cisco Catalyst SD-WAN Controller or Manager to bypass authentication. This would grant them administrative privileges, allowing them to access NETCONF and manipulate the SD-WAN fabric configuration remotely.
- Requires network access to the device.
- Exploits the peering authentication mechanism.
- Bypasses login to gain high privileges.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation by threat actors. Given its critical severity and the ability to bypass authentication for administrative control and network manipulation, attackers are highly motivated to weaponize it. The rapid inclusion in KEV suggests a current and significant threat.
- Listed on CISA KEV.
- Allows administrative privilege escalation.
- Remote, unauthenticated exploitation.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching or updating Cisco Catalyst SD-WAN Controller and Manager systems immediately due to active exploitation and critical severity. If patching is delayed, isolate affected devices from the network and monitor for suspicious activity related to unauthorized configuration changes. Review logs for any signs of successful authentication bypass or NETCONF access.
- Apply Cisco security updates.
- Isolate vulnerable systems.
- Monitor for unauthorized access.
