Cisco SD-WAN Vmanage vulnerabilities

42 CVEs affecting Cisco SD-WAN Vmanage, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-20262, published 2023-09-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2021-1275, published 2021-05-06. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated,…
CVE-2021-1468, published 2021-05-06. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated,…
CVE-2021-1259, published 2021-01-20. Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain write access to…
CVE-2021-1479, published 2021-04-08. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated…
CVE-2021-1506, published 2021-05-06. High severity, CVSS 7.2. EPSS: 1.8% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated,…
CVE-2021-1480, published 2021-04-08. High severity, CVSS 7.8. EPSS: 1.8% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated…
CVE-2021-1508, published 2021-05-06. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated,…
CVE-2021-1505, published 2021-05-06. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated,…
CVE-2021-1349, published 2021-01-20. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected…

Latest

CVE-2023-20262, published 2023-09-27. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability in the SSH service of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to cause a process crash, resulting in a DoS condition for SSH access only. This…
CVE-2023-20253, published 2023-09-27. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass authorization and allow the attacker to roll…
CVE-2023-20179, published 2023-09-27. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This…
CVE-2023-20214, published 2023-08-03. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to gain read permissions or limited write…
CVE-2023-20098, published 2023-05-09. Medium severity, CVSS 6.0. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due to improper filtering of directory…
CVE-2022-20830, published 2022-10-10. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of…
CVE-2022-20930, published 2022-09-30. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite and possibly corrupt files on an affected system. This vulnerability is due to…
CVE-2022-20850, published 2022-09-30. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitrary files from the file system of an…
CVE-2022-20818, published 2022-09-30. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on…
CVE-2022-20696, published 2022-09-08. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the binding configuration of Cisco SD-WAN vManage Software containers could allow an unauthenticated, adjacent attacker who has access to the VPN0 logical network to also access…