Cisco Catalyst SD-WAN Manager REST API Privilege Escalation

Successful exploitation allows an authenticated attacker who already has low-privileged local access to obtain root privileges on the underlying operating system. This results in full compromise of the affected SD-WAN Manager instance, including complete control over system configuration and services, access to sensitive data on the appliance, and the ability to modify or disrupt system operation.

If immediate patching is not possible, restrict access to Cisco Catalyst SD-WAN Manager management interfaces and REST API from unsecured or untrusted networks, place the appliance behind a firewall, and reduce exposure of the management plane. The provided content also recommends disabling unnecessary services such as HTTP and FTP, disabling HTTP for the web UI administrator portal where applicable, enforcing SSL/TLS for management communications, changing default administrator credentials, monitoring logs for anomalous API activity or unexpected traffic, and conducting compromise assessment activities until upgrades are completed.

Upgrade Cisco Catalyst SD-WAN Manager to a fixed software release as specified by Cisco. The provided content states Cisco released patches for this vulnerability and gives the following fixed releases across supported trains: 20.9.8.2 for 20.9, 20.12.5.3 or 20.12.6.1 for 20.12, 20.15.4.2 for 20.13 through 20.15, and 20.18.2.1 for 20.16 and 20.18. Versions earlier than 20.9.1 require migration to a fixed release. Follow Cisco's advisory and upgrade matrix for the appropriate target version.