Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Cisco has identified a critical vulnerability in its Catalyst SD-WAN Controller that could allow unauthenticated attackers to bypass authentication and gain administrative privileges on affected systems.
The vulnerability exists in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond. An attacker could exploit this by sending crafted requests to an affected system, potentially logging in as an internal, high-privileged non-root user account.
Once authenticated, the attacker could access NETCONF, allowing them to manipulate network configuration for the entire SD-WAN fabric. This poses significant risks to organizations relying on Cisco's SD-WAN solutions for their network infrastructure.
Affected Deployments
The vulnerability affects multiple deployment types including On-Prem Deployment, Cisco Hosted SD-WAN Cloud, Cisco Hosted SD-WAN Cloud - Cisco Managed, and Cisco Hosted SD-WAN Cloud - FedRAMP Environment. Regardless of device configuration, all listed products are potentially vulnerable.
Systems exposed to the internet with ports accessible externally are at particular risk of compromise. Customers are encouraged to audit the auth.log file at /var/log/auth.log for suspicious entries, specifically looking for 'Accepted publickey for vmanage-admin from unknown or unauthorized IP addresses'.
Detection and Response
To determine if a system has been compromised, customers should validate peering events against known maintenance windows, scheduled configuration changes, and normal operational hours. They should confirm that public IP addresses correspond to infrastructure owned by their organization or authorized partners.
A comprehensive review process is essential to distinguish between legitimate network operations and potential indicators of compromise.
Customers should verify that peer system IPs match documented device assignments within their SD-WAN topology and ensure peer types align with expected device roles. Correlating multiple events from the same source IP can help identify patterns of reconnaissance or persistent access attempts.
Mitigation and Patching
Cisco has released software updates that address this vulnerability, but no workarounds exist. For on-prem deployments, customers may temporarily mitigate the impact by adding access control lists (ACLs), security group rules, or firewall rules to restrict traffic to ports 22 and 830, allowing only known controller IPs.
The security team recommends upgrading to fixed software releases as soon as possible. For releases earlier than 20.9, customers must migrate to a fixed release.
Organizations should evaluate the applicability and effectiveness of any mitigations in their own environment before deployment, as these measures may negatively impact functionality or performance based on specific deployment scenarios.
Related
