Cisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerability

A vulnerability exists in the web UI of Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) that could allow an unauthenticated, remote attacker to read arbitrary files from the affected system. This issue arises from improper handling of XML External Entity (XXE) entries during XML file parsing. Exploitation involves sending a crafted request to the system, which could result in unauthorized file access.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the affected system.

Remediation

Cisco has released software updates to address this vulnerability. Customers are advised to upgrade to the latest version of Cisco Catalyst SD-WAN Software. For additional guidance, consult the Cisco Catalyst SD-WAN Upgrade Matrix and the Cisco Catalyst SD-WAN Hardening Guide.