High severity · published Jan 24, 2019
CVE-2019-1647
Cisco SD-WAN Solution Unauthorized Access Vulnerability
8.0
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, adjacent attacker to bypass authentication and have direct unauthorized access to other vSmart containers. The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit this vulnerability by directly connecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cisco SD-WAN Solution · Cisco
All versions, or not specified · source: vendor
SD
Sd-wan · Cisco
before 18.4.0 · source: NVD
VC
Vsmart Controller · Cisco
All versions, or not specified · source: NVD
Affected product
CS
Cisco SD-WAN Solution
Cisco
More from Cisco SD-WAN Solution
8.8
CVE-2019-1650
Cisco SD-WAN Solution Arbitrary File Overwrite Vulnerability
8.8
CVE-2019-1651
Cisco SD-WAN Solution Buffer Overflow Vulnerability
7.8
CVE-2022-20818
Cisco SD-WAN Software Privilege Escalation Vulnerabilities
7.8
CVE-2019-1648
Cisco SD-WAN Solution Privilege Escalation Vulnerability
7.8
CVE-2019-1646
Privilege Escalation Vulnerability in Cisco SD-WAN Solution