Skip to content
OpenAdvisories
Medium WID-SEC-2025-0963 6 CVEs

Cisco Catalyst SD-WAN Manager: Mehrere Schwachstellen

Published May 7, 2025 · Updated May 8, 2025 · Revision 2 · de-DE

Vendor: Cisco Product: Catalyst SD-WAN Manager

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in Cisco Catalyst SD-WAN Manager ausnutzen, um erweiterte Rechte zu erlangen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren und vertrauliche Informationen preiszugeben.

Product

Cisco Catalyst SD-WAN ist eine Netzwerklösung, die Software-definierte Wide-Area-Networking-Funktionen (SD-WAN) mit Cisco Catalyst Series Switches kombiniert, um die Netzwerkleistung an verteilten Standorten zu optimieren und zu sichern.

Vulnerabilities 6

  • High 7.8
    CVE-2025-20122

    Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability

    A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to gain privileges of the root user on the underlying operating system. This vulnerability is due to insufficient input va…

    Cisco Cisco Catalyst SD-WAN Manager Network devices
  • Medium 6.5
    CVE-2025-20187

    Cisco SD-WAN Manager Software Arbitrary File Creation Vulnerability

    A vulnerability in the application data endpoints of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to write arbitrary files to an affected system. This vulnerability is due to improper validation o…

    Cisco Cisco Catalyst SD-WAN Manager Network devices
  • Medium 5.9
    CVE-2025-20157

    Cisco Catalyst vManage Certificate Validation Vulnerability

    A vulnerability in certificate validation processing of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote attacker to gain access to sensitive information. This vulnerability is due to improper validation of …

    Cisco Cisco Catalyst SD-WAN Manager Network devices
  • Medium 5.5
    CVE-2025-20213

    Cisco Catalyst SDWAN Manager Arbitrary File Overwrite Vulnerability

    A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. To exploit this vulnerability, the attacker m…

    Cisco Cisco Catalyst SD-WAN Manager Network devices
  • Medium 5.4
    CVE-2025-20147

    Cisco SD-WAN vManage Stored Cross-Site Scripting Vulnerability

    A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack (XSS) on an affected system.  This vulner…

    Cisco Cisco Catalyst SD-WAN Manager Network devices
  • Medium 4.7
    CVE-2025-20216

    Cisco Catalyst SD-WAN Manager Reflected HTML Injection Vulnerability

    A vulnerability in the web interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote attacker to inject HTML into the browser of an authenticated user. This vulnerability is due to improper sanitization …

    Cisco Cisco Catalyst SD-WAN Manager Network devices

Revision history

  1. #2

    PoC aufgenommen

  2. #1

    Initiale Fassung

References