CVE-2020-27129 Cisco SD-WAN vManage Software Command Injection Vulnerability

Medium 6.7 Published 6 Nov 2020 Updated 13 Nov 2024

Authenticated local attackers can inject arbitrary commands into Cisco SD-WAN vManage to gain elevated privileges.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-27129?

CVE-2020-27129 is a medium-severity command injection vulnerability in Cisco SD-WAN vManage, published on 6 Nov 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and potentially gain elevated privileges. The vulnerability is due to improper validation of commands to the remote management CLI of the affected application. An attacker could exploit this vulnerability by sending malicious requests to the affected application. A successful exploit could allow the attacker to inject arbitrary commands and potentially gain elevated privileges.

Weakness: CWE-88

Which versions are affected by CVE-2020-27129?

It affects 1 product.

Products include Cisco Sd-Wan Vmanage.

How do I fix CVE-2020-27129?

No fix has been published for CVE-2020-27129 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-27129 being exploited?

There is no known exploitation of CVE-2020-27129 in the wild and no public exploit code.

Sources

Also known as GHSA-97vg-w35f-v8mj.