Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability

An authenticated, remote attacker could exploit a vulnerability in the API of Cisco Catalyst SD-WAN Manager to overwrite arbitrary files on the local file system. This issue arises from improper file handling in the API interface. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. A successful exploit could allow the attacker to overwrite files and gain vmanage user privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized file modifications on the affected system, potentially allowing for privilege escalation to the vmanage user role.

Remediation

Cisco has released software updates that address this vulnerability. Customers are advised to upgrade to the latest version of Cisco Catalyst SD-WAN Manager. For guidance on which release to upgrade to, consult the Cisco Catalyst SD-WAN Upgrade Matrix.