CVE-2020-26071

Cisco SD-WAN vEdge Arbitrary File Creation Vulnerability

State: Published
Severity: 8.4 High
Published: Nov 18, 2024
Updated: Nov 18, 2024
Reserved: Sep 24, 2020

Description

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to create or overwrite arbitrary files on an affected device, which could result in a denial of service (DoS) condition. The vulnerability is due to insufficient input validation for specific commands. An attacker could exploit this vulnerability by including crafted arguments to those specific commands. A successful exploit could allow the attacker to create or overwrite arbitrary files on the affected device, which could result in a DoS condition.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H/RL:X/RC:X/E:X	cisco

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
Cisco Catalyst SD-WAN ManagerCisco	20.1.12Affected 19.2.1Affected 18.4.4Affected 18.4.5Affected 20.1.1.1Affected 20.1.1Affected 19.3.0Affected 19.2.2Affected 19.2.099Affected 18.3.6Affected 18.3.7Affected 19.2.0Affected 18.3.8Affected 19.0.0Affected 19.1.0Affected 18.4.302Affected 18.4.303Affected 19.2.097Affected 19.2.098Affected 17.2.10Affected 18.3.6.1Affected 19.0.1aAffected 18.2.0Affected 18.4.3Affected 18.4.1Affected and 17 more versions
Cisco SD-WAN vContainerCisco	18.4.5Affected 20.1.12Affected 18.3.6Affected 19.2.1Affected 19.3.0Affected 20.1.1Affected 19.2.2Affected 18.3.8Affected 18.4.3Affected 18.4.4Affected 18.4.302Affected 19.1.0Affected 18.4.303Affected 19.2.0Affected 19.2.098Affected 17.2.10Affected 18.3.7Affected 18.3.1Affected 19.2.099Affected 19.2.097Affected 18.3.4Affected 18.2.0Affected 18.3.5Affected 18.4.1Affected 17.2.5Affected and 9 more versions
Cisco SD-WAN vEdge CloudCisco	19.2.1Affected 20.1.12Affected 18.4.4Affected 19.3.0Affected 18.3.8Affected 19.2.2Affected 20.1.1Affected 18.3.6Affected 18.4.3Affected 18.4.302Affected 18.4.5Affected 18.4.303Affected 19.2.098Affected 19.1.0Affected 17.2.10Affected 19.0.1aAffected 19.2.099Affected 18.3.7Affected 19.2.097Affected 18.3.1Affected 19.2.0Affected 17.2.9Affected 18.3.4Affected 18.2.0Affected 18.4.1Affected and 10 more versions
Cisco SD-WAN vEdge RouterCisco	18.4.303Affected 18.3.7Affected 19.3.0Affected 18.2.0Affected 20.1.12Affected 19.2.099Affected 17.2.10Affected 18.3.3Affected 18.3.6Affected 19.0.0Affected 17.2.6Affected 18.4.0Affected 19.1.01Affected 19.2.098Affected 18.3.1Affected 18.4.302Affected 19.2.2Affected 18.3.5Affected 17.2.9Affected 19.1.0Affected 20.1.11Affected 19.2.097Affected 18.4.5Affected 17.2.5Affected 17.2.8Affected and 13 more versions

References

cisco-sa-vsoln-arbfile-gtsEYxns

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.