Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability has been identified in Cisco Catalyst SD-WAN Manager that could allow an authenticated, local user with administrative privileges to execute arbitrary commands as root. This issue stems from insufficient validation of user-supplied input, potentially leading to command injection and privilege escalation. While an attacker needs initial access and specific privileges, observed exploitation has resulted in configuration changes to edge devices.
- Local users with admin rights can run commands as root.
- It allows deeper control over network configurations.
- Confirm if the affected system is relevant to operations.
Attack Path
How an attacker could exploit the issue
An attacker with administrative privileges on a Cisco Catalyst SD-WAN Manager can upload a specially crafted file to the system. This file exploits a weakness in how the system handles user input, allowing the attacker to inject and run their own commands with root-level access, potentially leading to unauthorized changes on edge devices.
- Requires netadmin privileges to initiate.
- Triggered by uploading a crafted file.
- Enables command injection and privilege escalation.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an authenticated local attacker with netadmin privileges to execute arbitrary commands as the root user by uploading a crafted file to the system. This could result in configuration changes being pushed to edge devices.
- System command execution and configuration.
- Uploading a crafted file to the system.
- Unauthorized configuration changes pushed to edge devices.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability affects Cisco Catalyst SD-WAN Manager and requires local administrative access for exploitation. Action should be coordinated between the platform or infrastructure team responsible for the SD-WAN Manager and the security team. The first practical step involves identifying all instances of the affected system, confirming their business criticality and network exposure, and then planning remediation based on risk, potentially coordinating with Cisco for software updates.
- Platform/Infrastructure teams own remediation.
- Verify system criticality and network exposure.
- Coordinate software upgrades with Cisco.
