CVE-2019-1646

Description

A vulnerability in the local CLI of the Cisco SD-WAN Solution could allow an authenticated, local attacker to escalate privileges and modify device configuration files. The vulnerability exists because user input is not properly sanitized for certain commands at the CLI. An attacker could exploit this vulnerability by sending crafted commands to the CLI of an affected device. A successful exploit could allow the attacker to establish an interactive session with elevated privileges. The attacker could then use the elevated privileges to further compromise the device or obtain additional configuration data from the device.

Risk Information

Base Score
7.8
MODERATE
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.098

Associated Vulnerability

VulnerabilityOS Platform
Multiple Privilege Escalation Vulnerabilities in Cisco SD-WAN Solution For Cisco vEdge RouterNCM
Multiple Privilege Escalation Vulnerabilities in Cisco SD-WAN Solution For Cisco SD-WANNCM
Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability (CVE-2019-1646)NCM

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-1705270Security Update for Cisco vEdge Router sdwan-19.2.2
PATCH-1705297Security Update for Cisco SD-WAN sdwan-20.4(0.55)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234