CVE-2019-1648 Cisco SD-WAN Solution Privilege Escalation Vulnerability

High 7.8 Published 24 Jan 2019 Updated 20 Nov 2024

An authenticated local attacker can gain root privileges by writing a crafted file to the user group configuration directory in Cisco SD-WAN.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-1648?

CVE-2019-1648 is a high-severity vulnerability in Cisco SD-WAN Solution, published on 24 Jan 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the group configuration. An attacker could exploit this vulnerability by writing a crafted file to the directory where the user group configuration is located in the underlying operating system. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device.

Weakness: CWE-20, CWE-264

Which versions are affected by CVE-2019-1648?

It affects 8 products.

Products include Cisco Sd-Wan, Cisco Vbond Orchestrator, Cisco Vedge 1000 Firmware, Cisco Vedge 100 Firmware, Cisco Vedge 2000 Firmware, Cisco Vedge 5000 Firmware and 2 more.

How do I fix CVE-2019-1648?

No fix has been published for CVE-2019-1648 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-1648 being exploited?

There is no known exploitation of CVE-2019-1648 in the wild and no public exploit code.

Sources

Also known as GHSA-2249-5x8x-97jc.