Cisco SD-WAN vManage CLI Auth Bypass Enables Config Rollback Attack
CVE-2023-20253 Published on September 27, 2023

A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass authorization and allow the attacker to roll back the configuration on vManage controllers and edge router device. This vulnerability is due to improper access control in the cli-management interface of an affected system. An attacker with low-privilege (read only) access to the cli could exploit this vulnerability by sending a request to roll back the configuration on for other controller and devices managed by an affected system. A successful exploit could allow the attacker to to roll back the configuration on for other controller and devices managed by an affected system.

NVD

Vulnerability Analysis

CVE-2023-20253 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity and availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Incorrect User Management

The software does not properly manage a user within its environment. Users can be assigned to the wrong group (class) of permissions resulting in unintended access rights to sensitive objects.


Products Associated with CVE-2023-20253

stack.watch emails you whenever new vulnerabilities are published in Cisco Sd Wan Vmanage or Cisco Catalyst Sd Wan Manager. Just hit a watch button to start following.

Cisco Sd Wan Vmanage
 
Cisco Catalyst Sd Wan Manager
 

Affected Versions

Cisco SD-WAN vManage:

Exploit Probability

EPSS
0.01%
Percentile
0.27%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.