Cisco has released a High severity security update that fixes an IOS XE SD-WAN software command injection vulnerability CVE-2019-16011.
An authenticated, local attacker could exploit the vulnerability in the CLI of Cisco IOS XE SD-WAN Software. As a result, an attacker could inject arbitrary commands with root privileges.
“The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. A successful exploit could allow the attacker to execute commands with root privileges,” Cisco warned in the advisory.
Impacted products
Cisco listed the following products impacted by the IOS XE SD-WAN vulnerability (CVE-2019-16011):
- 1000 Series Aggregation Services Routers
- 1000 Series Integrated Services Routers (ISRs)
- 4000 Series ISRs
- Cloud Services Router 1000V Series.
Cisco recommends to apply the necessary software updates to address this vulnerability.
Other security updates
Cisco also addressed a CSRF vulnerability CVE-2019-16009 in the web UI of Cisco IOS and Cisco IOS XE Software on April 28, 2020.
An unauthenticated, remote attacker could exploit and conduct a cross-site request forgery (CSRF) attack on an affected system.
The CSRF vulnerability affects Cisco devices running Cisco IOS or Cisco IOS XE Software earlier than 16.1.1, with the HTTP Server feature enabled.
Each of the vulnerabilities are rated High severity and should be high priority to address.