====================================================================


                             CERT-Renater

                 Note d'Information No. 2018/VULN271
_____________________________________________________________________

DATE                : 06/09/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco SD-WAN Solution.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-sd-wan-escalation
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-sd-wan-injection
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-sd-wan-validation
_____________________________________________________________________

Cisco Security Advisory: Cisco SD-WAN Solution Privilege Escalation
Vulnerability

Advisory ID: cisco-sa-20180905-sd-wan-escalation

Revision: 1.0

For Public Release: 2018 September 5 16:00 GMT

Last Updated: 2018 September 5 16:00 GMT

CVE ID(s): CVE-2018-0432

CVSS Score v(3): 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

+---------------------------------------------------------------------

Summary

=======

A vulnerability in the error reporting feature of the Cisco SD-WAN
Solution could allow an authenticated, remote attacker to gain elevated
privileges on an affected device.

  The vulnerability is due to a failure to properly validate certain
parameters included within the error reporting application
configuration. An attacker could exploit this vulnerability by sending a
crafted command to the error reporting feature. A successful exploit
could allow the attacker to gain root-level privileges and take full
control of the device.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-sd-wan-escalation
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-sd-wan-escalation"]

_____________________________________________________________________

Cisco Security Advisory: Cisco SD-WAN Solution Command Injection
Vulnerability

Advisory ID: cisco-sa-20180905-sd-wan-injection

Revision: 1.0

For Public Release: 2018 September 5 16:00 GMT

Last Updated: 2018 September 5 16:00 GMT

CVE ID(s): CVE-2018-0433

CVSS Score v(3): 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

+---------------------------------------------------------------------

Summary

=======

A vulnerability in the command-line interface (CLI) in the Cisco SD-WAN
Solution could allow an authenticated, local attacker to inject
arbitrary commands that are executed with root privileges.

  The vulnerability is due to insufficient input validation. An attacker
could exploit this vulnerability by authenticating to the device and
submitting crafted input to the CLI utility.

  The attacker must be authenticated to access the CLI utility. A
successful exploit could allow the attacker to execute commands with
root privileges.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-sd-wan-injection
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-sd-wan-injection"]
_____________________________________________________________________

Cisco Security Advisory: Cisco SD-WAN Solution Certificate Validation
Vulnerability

Advisory ID: cisco-sa-20180905-sd-wan-validation

Revision: 1.0

For Public Release: 2018 September 5 16:00 GMT

Last Updated: 2018 September 5 16:00 GMT

CVE ID(s): CVE-2018-0434

CVSS Score v(3): 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

+---------------------------------------------------------------------

Summary

=======

A vulnerability in the Zero Touch Provisioning feature of the Cisco
SD-WAN Solution could allow an unauthenticated, remote attacker to gain
unauthorized access to sensitive data by using an invalid certificate.

  The vulnerability is due to insufficient certificate validation by the
affected software. An attacker could exploit this vulnerability by
supplying a crafted certificate to an affected device. A successful
exploit could allow the attacker to conduct man-in-the-middle attacks to
decrypt confidential information on user connections to the affected
software.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-sd-wan-validation
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-sd-wan-validation"]

=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================