EUVD-2026-36733
GHSA-p45r-gcc9-fr7f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible API requires only low-privilege credentials (PR:L); path traversal yields high integrity impact with no direct confidentiality or availability consequence.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.
This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.
Articles & Coverage 1
AnalysisAI
Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated low-privileged attacker to create or overwrite any file on the underlying operating system by sending crafted HTTP requests to affected API endpoints. The vulnerability stems from insufficient validation of user-supplied input during the file upload process (CWE-22), and a successful exploit can serve as a reliable stepping stone to root-level privilege escalation on the management host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of valid Cisco Catalyst SD-WAN Manager credentials at a minimum of the 'lower-privileged, single-task' role - this is the lowest defined access tier in the platform, not administrator access, meaning any authenticated user is a potential threat actor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N yields a 6.5 Medium score, which underrepresents the true operational risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has acquired a low-privileged single-task account on Cisco Catalyst SD-WAN Manager - obtained through credential phishing, password spraying against exposed management interfaces, or insider access - authenticates to the web UI and submits a crafted HTTP POST request to the file upload API endpoint with path traversal sequences embedded in the filename or destination path parameter (e.g., '../../var/spool/cron/root'). The server writes attacker-controlled content - a reverse shell cron entry or malicious SSH public key - directly to the OS filesystem, which is subsequently executed with root-level privileges, granting the attacker full control of the SD-WAN Manager host and the ability to manipulate SD-WAN policy across the entire managed network. … |
| Remediation | Apply the vendor-supplied patch by consulting the Cisco Security Advisory cisco-sa-sdwan-arbfw-c2rZvQ at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ for specific fixed release versions; a confirmed fixed version number was not available in the provided intelligence data and must not be assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today