Privilege Escalation in Cisco Catalyst SD-WAN Manager REST API

Successful exploitation results in full root-level compromise of the underlying operating system hosting Cisco Catalyst SD-WAN Manager. This enables complete administrative control over the appliance, including the ability to access and modify sensitive data, alter system configuration, interfere with service availability, and use the compromised system as a foothold for further operations within the SD-WAN management environment.

If immediate patching is not possible, restrict access to Cisco Catalyst SD-WAN Manager management interfaces and REST API endpoints to trusted administrative networks only, remove direct exposure from unsecured networks, and place the platform behind a firewall. Disable unnecessary network services, including HTTP and FTP where not required, prefer encrypted management access, and closely monitor authentication and API activity for anomalous requests or privilege changes. Conduct compromise assessment and log review to identify unauthorized administrative actions or unexpected system modifications until remediation is completed.

Upgrade Cisco Catalyst SD-WAN Manager to a fixed release. Reported fixed versions include 20.9.8.2 for the 20.9 train, 20.12.5.3 or 20.12.6.1 for affected 20.11/20.12 deployments as applicable, 20.15.4.2 for affected 20.13 through 20.15 deployments, and 20.18.2.1 for affected 20.16 and 20.18 deployments. Versions earlier than 20.9.1 require migration to a supported fixed release. Apply the vendor-provided security update according to the appropriate upgrade path for the deployed release train.