Cybersecurity specialists report the detection of a critical privilege escalation vulnerability in the IOS IE operating system that would allow threat actors to execute arbitrary code in Cisco SD-WAN deployments.
As some users will recall, this family of products allows businesses of any size to connect different office locations via the cloud using various network technologies, including standard Internet connections. Devices at each location enable advanced analytics, monitoring, application-specific performance specifications, and automation for any connection across a company’s wide area network.
Tracked as CVE-2021-1529, the flaw was described as a command injection that would allow code execution in areas of the operating system that should be restricted under normal conditions. To be specific, the flaw lies in the command line interface (CLI) of the Cisco IOS XE SD-WAN software; successful exploitation of the flaw would allow the execution of arbitrary commands with root user privileges.
In its security alert, Cisco notes that the vulnerability exists due to insufficient validation of CLI entries and successful exploitation would require authentication on the affected system and sending a specially crafted entry to the affected CLI: “Successful compromise would allow hackers to read and write any files to the system, perform operations like any user, and change system configurations, among other actions,” says Cisco.
While the vulnerability received a score of 7.8/10 according to the Common Vulnerability Scoring System (CVSS), the Cybersecurity and Infrastructure Security Agency (CISA) issued a statement asking users of affected deployments to update as soon as possible.
Cisco has released multiple updates for SD-WAN during 2021; In January, the firm released multiple patches to address command injection and buffer overflow failures in SD-WAN, which could be exploited by unauthenticated threat actors for arbitrary code execution on the target system.
Months later, the company fixed two critical flaws in vManage SD-WAN that would have allowed unauthenticated malicious hackers to execute remote code on corporate networks.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a cyber security and malware researcher. He studied Computer Science and started working as a cyber security analyst in 2006. He is actively working as an cyber security investigator. He also worked for different security companies. His everyday job includes researching about new cyber security incidents. Also he has deep level of knowledge in enterprise security implementation.