Quantum Secular Labs / Blog / Advisories

CVE-2018-0349: Cisco Vbond Orchestrator: Improper Input Validation

CVE-2018-0349 is rated critical with a CVSS v3.1 base score of 9.8 and affects Cisco Vbond Orchestrator, along with 9 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper input validation of the request admin-tech command in the CLI of the affected software. An attacker could exploit this vulnerability by modifying the request admin-tech command in the CLI of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying operating system of an affected device and escalate their privileges to the root user. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vEdge 100 Series Routers, vEdge 1000 Series Routers, vEdge 2000 Series Routers, vEdge 5000 Series Routers, vEdge Cloud Router Platform, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi69852, CSCvi69856.

Severity breakdown

CVSS v3.1 9.8: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Unchanged. Impact stays within the vulnerable component.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-20: Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-78: Improper Neutralization of Special Elements used in an OS Command

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

Affected products

  • Cisco Vbond Orchestrator: all versions listed by NVD
  • Cisco Vmanage Network Management: all versions listed by NVD
  • Cisco Vsmart Controller: all versions listed by NVD
  • Cisco Vedge Plus: all versions listed by NVD
  • Cisco Vedge Pro: all versions listed by NVD
  • Cisco Vedge 100 Firmware: before 18.3.0
  • Cisco Vedge 100b Firmware: before 18.3.0
  • Cisco Vedge 100m Firmware: before 18.3.0
  • Cisco Vedge 100wm Firmware: before 18.3.0
  • Cisco Vedge 1000 Firmware: before 18.3.0
  • Cisco Vedge 2000 Firmware: before 18.3.0
  • Cisco Vedge 5000 Firmware: before 18.3.0

References