Security News > 2023 > September > Cisco Catalyst SD-WAN Manager flaw allows remote server access
Cisco is warning of five new Catalyst SD-WAN Manager products vulnerabilities with the most critical allowing unauthenticated remote access to the server.
Cisco Catalyst SD-WAN Manager for WAN is network management software allowing admins to visualize, deploy, and manage devices on wide area networks.
The most severe of the disclosed flaws impacting the product is CVE-2023-20252, which allows unauthorized access due to issues with the Security Assertion Markup Language APIs.
"A vulnerability in the Security Assertion Markup Language APIs of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user," warns the security bulletin.
Catalyst SD-WAN Manager version 20.12, the latest available release, is not impacted by any flaws except for the medium severity one, so that's the safest version to upgrade to if possible.
Cisco BroadWorks impacted by critical authentication bypass flaw.
News URL
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-09-27 | CVE-2023-20252 | Improper Authentication vulnerability in Cisco Catalyst Sd-Wan Manager 20.11.1.2/20.9.3.2 A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to improper authentication checks for SAML APIs. | 9.8 |