Cisco has issued a warning regarding an authentication vulnerability present in the vManage software that accompanies its SD-WAN (Software-Defined Wide Area Network) solution. The vulnerability, identified as CVE-2023-20214, is rated as critical with a CVSS score of 9.1. It allows an unauthenticated remote attacker to gain read permissions or limited write permissions to the configuration of an affected Cisco SD-WAN vManage instance.
The root cause of the vulnerability lies in insufficient request validation within the REST API of vManage. Exploiting this flaw, an attacker can send a specially crafted API request to the vManage instance, potentially accessing and extracting information from the affected system.
In response to the issue, Cisco has released an advisory outlining steps for customers to monitor access attempts to the API through log files. Customers are advised to evaluate these access attempts to distinguish between legitimate requests and potential attacks. Cisco also recommends implementing access control lists to restrict API access to authorized IP addresses.
The affected versions of SD-WAN vManage include 20.6.3.3 (fixed in 20.6.3.4), 20.6.4 (fixed in 20.6.4.2), 20.6.5 (fixed in 20.6.5.5), 20.9 (fixed in 20.9.3.2), 20.10 (fixed in 20.10.1.2), and 20.11 (fixed in 20.11.1.2). Users with versions 20.7 or 20.8 will need to migrate to a fixed release in order to mitigate the vulnerability.