A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to gain privileges of the root user on the underlying operating system.
This vulnerability is due to insufficient input validation. An authenticated attacker with read-only privileges on the SD-WAN Manager system could exploit this vulnerability by sending a crafted request to the CLI of the SD-WAN Manager. A successful exploit could allow the attacker to gain root privileges on the underlying operating system.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Wed, 07 May 2025 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 07 May 2025 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to gain privileges of the root user on the underlying operating system. This vulnerability is due to insufficient input validation. An authenticated attacker with read-only privileges on the SD-WAN Manager system could exploit this vulnerability by sending a crafted request to the CLI of the SD-WAN Manager. A successful exploit could allow the attacker to gain root privileges on the underlying operating system. | |
| Title | Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability | |
| Weaknesses | CWE-300 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: cisco
Published: 2025-05-07T17:18:27.333Z
Updated: 2025-05-08T03:56:28.948Z
Reserved: 2024-10-10T19:15:13.211Z
Link: CVE-2025-20122
Vulnrichment
Updated: 2025-05-07T18:56:23.009Z
NVD
Status : Awaiting Analysis
Published: 2025-05-07T18:15:36.290
Modified: 2025-05-08T14:39:09.683
Link: CVE-2025-20122
Redhat
No data.