CVE-2020-3381: high-severity vulnerability in Cisco SD-WAN vManage
Cisco SD-WAN vManage Software Directory Traversal Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 2.6%
A vulnerability in the web management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct directory traversal attacks and obtain read and write access to sensitive files on a targeted system. The vulnerability is due to a lack of proper validation of files that are uploaded to an affected device. An attacker could exploit this vulnerability by uploading a crafted file to an affected system. An exploit could allow the attacker to view or modify arbitrary files on the targeted system.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco SD-WAN vManageRelated CVEs — Cisco SD-WAN vManage
In the same product, most dangerous first.
CVE-2020-27128MEDIUMCisco SD-WAN vManage Software Arbitrary File Creation VulnerabilityEPSS 58.5%CVE-2020-3387HIGHCisco SD-WAN vManage Software Remote Code Execution VulnerabilityEPSS 13.0%CVE-2020-3375CRITICALCisco SD-WAN Solution Software Buffer Overflow VulnerabilityEPSS 3.9%CVE-2020-3437MEDIUMCisco SD-WAN vManage Software Information Disclosure VulnerabilityEPSS 2.9%CVE-2020-3401MEDIUMCisco SD-WAN vManage Software Path Traversal VulnerabilityEPSS 2.6%CVE-2021-1275CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 2.1%