CVE-2019-1648 (CNNVD-201901-868)
中文标题:
Cisco SD-WAN Solution 权限许可和访问控制问题漏洞
英文标题:
Cisco SD-WAN Solution Privilege Escalation Vulnerability
漏洞描述
中文描述:
Cisco vBond Orchestrator Software等都是美国思科（Cisco）公司的产品。Cisco vBond Orchestrator Software是一套安全网络扩展管理软件。vEdge 100 Series Routers是一款100系列的路由器产品。SD-WAN Solution是运行在其中的一套网络扩展解决方案。 Cisco SD-WAN Solution 18.4.0之前版本中的用户组群配置存在提权漏洞，该漏洞源于程序没有正确地验证参数。远程攻击者可通过向用户组群配置所在的底层操作系统的目录写入特制的文件利用该漏洞获取root级别的权限并控制设备。以下产品受到影响：Cisco vBond Orchestrator Software；vEdge 100 Series Routers；vEdge 1000 Series Routers；vEdge 2000 Series Routers；vEdge 5000 Series Routers；vEdge Cloud Router Platform；vManage Network Management Software；vSmart Controller Software。
英文描述:
A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the group configuration. An attacker could exploit this vulnerability by writing a crafted file to the directory where the user group configuration is located in the underlying operating system. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco SD-WAN Solution | n/a | - | - |
cpe:2.3:a:cisco:cisco_sd-wan_solution:n_a:*:*:*:*:*:*:*
|
| cisco | vedge_100_firmware | * | - | - |
cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*
|
| cisco | vedge_1000_firmware | * | - | - |
cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*
|
| cisco | vedge_2000_firmware | * | - | - |
cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*
|
| cisco | vedge_5000_firmware | * | - | - |
cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*
|
| cisco | sd-wan | * | - | - |
cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*
|
| cisco | vbond_orchestrator | - | - | - |
cpe:2.3:a:cisco:vbond_orchestrator:-:*:*:*:*:*:*:*
|
| cisco | vmanage_network_management | - | - | - |
cpe:2.3:a:cisco:vmanage_network_management:-:*:*:*:*:*:*:*
|
| cisco | vsmart_controller | - | - | - |
cpe:2.3:a:cisco:vsmart_controller:-:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.0 (cna)
HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2019-1648 |
2025-11-11 15:20:08 | 2025-11-11 07:35:37 |
| NVD | nvd_CVE-2019-1648 |
2025-11-11 14:56:20 | 2025-11-11 07:44:08 |
| CNNVD | cnnvd_CNNVD-201901-868 |
2025-11-11 15:10:09 | 2025-11-11 07:54:18 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 输入验证错误
- cnnvd_id: 未提取 -> CNNVD-201901-868
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 9
- data_sources: ['cve'] -> ['cve', 'nvd']