Vulnerability in Cisco Catalyst SD-WAN Manager Exposes Passwords

What changed

A significant vulnerability has been identified in the Cisco Catalyst SD-WAN Manager, specifically within the Data Collection Agent (DCA) feature. This flaw allows an unauthenticated remote attacker to potentially gain user privileges by exploiting the way passwords are stored.

• The vulnerability arises from a credential file that contains the DCA password.
• Attackers can exploit this by sending crafted HTTP requests to the affected system.
• Successful exploitation can lead to unauthorized access to other systems with DCA user privileges.

Who is affected

Various users of the Cisco Catalyst SD-WAN Manager are at risk due to this vulnerability, particularly those utilizing the affected version.

Organizations relying on this system for network management should be aware of the implications.

• Cisco Catalyst SD-WAN Manager users, especially those on release 20.18.
• Network administrators managing multiple systems using DCA.
• Organizations that prioritize network security and data integrity.

What to do

It is crucial for affected users to assess their systems and implement necessary security measures to mitigate this vulnerability. Regular updates and patches from Cisco should be monitored and applied promptly.

Organizations should also review their password management practices to ensure sensitive information is securely stored.

• Update to the latest version of Cisco Catalyst SD-WAN Manager as soon as possible.
• Implement additional security measures such as network segmentation and access controls.
• Educate staff on recognizing and responding to potential security threats.