Cisco Cisco Catalyst SD-WAN Manager
At a glance
- Source
- NVD
- EPSS
- EPSS 31.48 % · percentile 98 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Analyzed
Description
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | cisco |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · psirt@cisco.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-8678
- GCVE · GCVE-0-2026-20133
CERT-FR advisories
- CERTFR-2026-AVI-0210 — Multiples vulnérabilités dans Cisco Catalyst SD-WAN · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*< 20.9.8.2cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*≥ 20.10 < 20.12.5.3cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*≥ 20.13 < 20.15.4.2cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*≥ 20.16 < 20.18.2.1cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Cisco · Cisco Catalyst SD-WAN Manager | affected 17.2.6 ; affected 17.2.7 ; affected 17.2.8 ; affected 17.2.9 ; affected 17.2.10 ; affected 17.2.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |