Cisco
This is rated medium severity (5.4 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Cisco Catalyst Sd Wan Manager is in your estate.
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
Exploitable over the network with a low-privilege account, and no one has to click or open anything. Low impact on confidentiality and integrity.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Exploitability
Longer bar: easier to attack
Impact
Longer bar: more harm
2 links from the CVE record, grouped by site; the vendor's advisory comes first.
sec.cloudapps.cisco.com1 linkVendor advisory
cisa.gov1 link
An attacker could exploit this vulnerability by uploading a malicious file on the local file system. Known-exploited catalogue reports exploitation in the wild.
Next step: Confirm whether Cisco Catalyst SD-WAN Manager is in your estate.
Who's reporting
1 of 3 perspectives
Official authority: Official 1Vendor statement missing. no VendorResearcher coverage missing. no Researcher1 signal
Only official coverage so far. Treat as an early signal.
