Vulnerability in Cisco Catalyst SD-WAN Manager Exposes Passwords

What changed

A critical vulnerability has been identified in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager. This flaw allows unauthenticated remote attackers to gain unauthorized DCA user privileges.

The issue arises from the storage of credentials in a recoverable format, specifically in a file that can be accessed by sending a crafted HTTP request.

Who is affected

Organizations utilizing Cisco Catalyst SD-WAN Manager, particularly those running version 20.18, are at risk. The vulnerability can lead to unauthorized access and privilege escalation.

This issue primarily impacts enterprises relying on Cisco's SD-WAN solutions for their network management.

• Cisco Catalyst SD-WAN Manager (version 20.18)
• Enterprises using Cisco's Data Collection Agent feature
• Organizations with remote access configurations

What to do

It is crucial for affected organizations to assess their systems for this vulnerability and implement necessary security measures. Immediate steps should be taken to secure credential storage and limit access to sensitive files.

Regular updates and patches should be applied to the Cisco Catalyst SD-WAN Manager to mitigate potential exploitation.

• Review and update to the latest version of Cisco Catalyst SD-WAN Manager.
• Implement stricter access controls to sensitive files.
• Monitor network traffic for unusual HTTP requests that may indicate exploitation attempts.