Path Traversal in Cisco Catalyst Sd-Wan Manager
CVE-2020-26073
A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within requests to application programmatic interfaces (APIs). An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and gain access to sensitive information including credentials or user tokens.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
EPSS: 0.126 (96.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Cisco Catalyst_sd-wan_manager — versions 17.2.4, 17.2.5, 17.2.6
- Cisco Catalyst Sd-wan Manager — versions 20.1.12, 19.2.1, 18.4.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@cisco.com (Vendor Advisory)
- psirt@cisco.com (Not Applicable)
- psirt@cisco.com (Not Applicable)
Frequently asked questions
- What is CVE-2020-26073?
- CVE-2020-26073 is a high-severity vulnerability in Cisco Catalyst Sd-Wan Manager, classified under Path Traversal: '.../...//'. CVSS score: 7.5/10. Published 2024-11-18.
- How severe is CVE-2020-26073?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2020-26073 known to be exploited?
- 10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.