CVE-2019-1651: cisco cisco sd-wan solution

Vulnerability summary

CVE-2019-1651 is a critical (CVSS 9.9) vulnerability in cisco cisco sd-wan solution. EPSS estimates a 4.85% chance of exploitation in the next 30 days, higher than 91.9% of scored vulnerabilities.

Timeline

1. 24-01-2019
   PublishedVulnerability first disclosed.
2. 20-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the vContainer of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and execute arbitrary code as the root user. The vulnerability is due to improper bounds checking by the vContainer. An attacker could exploit this vulnerability by sending a malicious file to an affected vContainer instance. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected vContainer, which could result in a DoS condition that the attacker could use to execute arbitrary code as the root user.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.