Summary
Cisco heeft een kwetsbaarheden verholpen in de Catalyst SD-WAN Controller en Manager producten.
Details
Interpretaties
Cisco heeft 4 kwetsbaarheden verholpen in de Catalyst SD-WAN Controller en Manager producten. De kwetsbaarheden betreffen XXE-injectie, privilege-escalatie en authentication bypass.
De authentication bypass kwetsbaarheid bevindt zich in het peering authenticatiemechanisme, waardoor niet-geauthenticeerde externe aanvallers verhoogde rechten kunnen verkrijgen. Hierdoor kunnen zij netwerkconfiguraties manipuleren en mogelijk netwerkoperaties verstoren.
Met name SD-WAN controllers die poorten via publieke netwerken bereikbaar hebben lopen een verhoogd risico op misbruik.
Cisco meldt bekend te zijn met berichten dat de authentication bypass kwetsbaarheid beperkt en gericht is misbruikt. De verwachting van het NCSC is dat op korte termijn een toename in scan- en misbruikverkeer zal plaatsvinden.
Oplossingen
Cisco heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Ook heeft Cisco Indicators of Compromise (IoC's) beschikbaar gesteld om eventueel misbruik te detecteren. Zie bijgevoegde referenties voor meer informatie.
Dreigingsinformatie
Customers are encouraged to audit the auth.log file, located at /var/log/auth.log, for entries that are related to Accepted publickey for vmanage-admin from unknown or unauthorized IP addresses, as shown in the following example:
`2026-02-10T22:51:36+00:00 vm sshd[804]: Accepted publickey for vmanage-admin from port [REDACTED PORT] ssh2: RSA SHA256:[REDACTED KEY]`
Customers must check the IP address in the auth.log log file against the configured System IPs that are listed in the Cisco Catalyst SD-WAN Manager web UI in the WebUI > Devices > System IP column.
Vulnerabilities 4
-
Critical 10.0
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The secti…
KEV May 14, 2026 -
High 8.6CVE-2026-20224 Public exploit
Cisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerability
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The attacker does not need to have valid user credentials. …
-
Medium 5.4
Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker with read-only permissions to elevate their privileges from low to high and perform actions as a high-privileged user. This …
-
Medium 5.4
Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker with read-only permissions to modify configurations and perform unauthorized actions on an affected system. This vulnerabili…
Revision history
-
#1.0.1
CVE-2026-20209, CVE-2026-20210, CVE-2026-20224 toegevoegd.
-
#1.0.0
Initiele versie