CVE-2026-20133
CVE-2026-20133
In short
A flaw in Cisco Catalyst SD-WAN Software allows someone with administrative network access to read sensitive files on the system through a command interface. This happens because the system doesn't properly restrict who can access certain files.
Technical detail
CWE-200 information disclosure vulnerability in Cisco Catalyst SD-WAN where authenticated users with netadmin privileges can access vshell and bypass file system restrictions to read sensitive operating system files. Attack requires valid credentials and administrative role; successful exploitation exposes confidential data on the underlying OS.
Summary generated and translated by AI from the official description.
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system.
This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Cisco · Cisco Catalyst SD-WAN ManagerWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →