High severity · published Jan 24, 2019
CVE-2019-1646
Privilege Escalation Vulnerability in Cisco SD-WAN Solution
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability in the local CLI of the Cisco SD-WAN Solution could allow an authenticated, local attacker to escalate privileges and modify device configuration files. The vulnerability exists because user input is not properly sanitized for certain commands at the CLI. An attacker could exploit this vulnerability by sending crafted commands to the CLI of an affected device. A successful exploit could allow the attacker to establish an interactive session with elevated privileges. The attacker could then use the elevated privileges to further compromise the device or obtain additional configuration data from the device.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cisco SD-WAN Solution · Cisco
All versions, or not specified · source: vendor
SD
Sd-wan · Cisco
before 18.4.0 · source: NVD
VO
Vbond Orchestrator · Cisco
All versions, or not specified · source: NVD
V1
Vedge 100 Firmware · Cisco
All versions, or not specified · source: NVD
V1
Vedge 1000 Firmware · Cisco
All versions, or not specified · source: NVD
V2
Vedge 2000 Firmware · Cisco
All versions, or not specified · source: NVD
V5
Vedge 5000 Firmware · Cisco
All versions, or not specified · source: NVD
VN
Vmanage Network Management · Cisco
All versions, or not specified · source: NVD
VC
Vsmart Controller · Cisco
All versions, or not specified · source: NVD
Affected product
CS
Cisco SD-WAN Solution
Cisco
More from Cisco SD-WAN Solution
8.8
CVE-2019-1650
Cisco SD-WAN Solution Arbitrary File Overwrite Vulnerability
8.8
CVE-2019-1651
Cisco SD-WAN Solution Buffer Overflow Vulnerability
8.0
CVE-2019-1647
Cisco SD-WAN Solution Unauthorized Access Vulnerability
7.8
CVE-2022-20818
Cisco SD-WAN Software Privilege Escalation Vulnerabilities
7.8
CVE-2019-1648
Cisco SD-WAN Solution Privilege Escalation Vulnerability