Cisco has issued a warning regarding five newly discovered vulnerabilities in its Catalyst SD-WAN Manager products. The most critical vulnerability, CVE-2023-20252, poses a significant risk by allowing unauthenticated remote access to the server due to issues with the Security Assertion Markup Language (SAML) APIs.
Attackers could exploit this flaw to gain unauthorized access, potentially leading to user impersonation, data breaches, and service disruptions. Additionally, four other vulnerabilities have been identified, including unauthorized configuration rollback, information disclosure, authorization bypass, and a Denial of Service (DoS) vulnerability.
CVE-2023-20034, while also remotely exploitable without authentication, is limited in severity as it only provides access to the Elasticsearch database with the privileges of the Elasticsearch user. The most urgent issue, CVE-2023-20252, affects specific releases of Catalyst SD-WAN Manager but not older versions or the latest release, version 20.12.
Users are strongly advised to upgrade to the latest patched release, as no workarounds have been provided for the fixed flaws. Cisco emphasizes the importance of addressing these vulnerabilities promptly, although none of them have been reported as actively exploited at this time.
