CVE-2021-1225: Cisco SD-WAN Vmanage

Critical severity, CVSS 9.1. EPSS: 1.4% chance of exploitation in the next 30 days.

Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities exist because the web-based management interface improperly validates values in SQL queries. An attacker could exploit these vulnerabilities by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on or return values from the underlying database or the operating system.

Affected products

• Cisco SD-WAN Vmanage: before 19.2.3 (fixed in 19.2.3)

Published 2021-01-20. Last modified 2026-06-17.