Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability

A vulnerability exists in Cisco Catalyst SD-WAN Manager due to inadequate file system access restrictions, allowing an unauthenticated, remote attacker to access sensitive information on the underlying operating system. Exploitation involves interacting with the system's API to retrieve this information.

Impact

Successful exploitation enables unauthorized access to sensitive information on the operating system of the affected system.

Remediation

Cisco has released software updates to address this vulnerability. For systems running versions earlier than 20.9, customers should migrate to a fixed release. For those on 20.9, the first fixed release is 20.9.8.2, estimated available on February 27, 2026. Customers on 20.11 should upgrade to 20.12.6.1, while those on 20.12.5 or 20.12.6 should move to 20.12.5.3 or 20.12.6.1, respectively. For versions 20.13, 20.14, and 20.15, the fixed release is 20.15.4.2. Users on 20.16 or 20.18 should upgrade to 20.18.2.1.