CVE-2019-1646
Description
A vulnerability in the local CLI of the Cisco SD-WAN Solution could allow an authenticated, local attacker to escalate privileges and modify device configuration files. The vulnerability exists because user input is not properly sanitized for certain commands at the CLI. An attacker could exploit this vulnerability by sending crafted commands to the CLI of an affected device. A successful exploit could allow the attacker to establish an interactive session with elevated privileges. The attacker could then use the elevated privileges to further compromise the device or obtain additional configuration data from the device.
Risk Information
Base Score
7.8
MODERATE
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.098
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Multiple Privilege Escalation Vulnerabilities in Cisco SD-WAN Solution For Cisco vEdge Router | NCM |
| Multiple Privilege Escalation Vulnerabilities in Cisco SD-WAN Solution For Cisco SD-WAN | NCM |
| Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability (CVE-2019-1646) | NCM |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-1705270 | Security Update for Cisco vEdge Router sdwan-19.2.2 |
| PATCH-1705297 | Security Update for Cisco SD-WAN sdwan-20.4(0.55) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234