A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerability is due to the existence of default credentials within the default configuration of an affected device. An attacker who has access to an affected device could log in with elevated privileges. A successful exploit could allow the attacker to take complete control of the device. This vulnerability affects Cisco devices that are running Cisco IOS XE SD-WAN Software releases 16.11 and earlier.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.00385.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco IOS XE SD-WAN Software affected
Version Status Constraints
16.11 and earlier affected —

Configuration 1 [-]

AND
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:csr1000v:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ir1101:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_56128p:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_5624q:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_5648q:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_5672up:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_5672up-16g:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_5696q:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ucs-e1120d-m3:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ucs-e140s-m2:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ucs-e160d-m2:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ucs-e160s-m3:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ucs-e180d-m2:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ucs-e180d-m3:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Cisco Subscribe
1100-4p Integrated Services Router Subscribe
1100-8p Integrated Services Router Subscribe
1101-4p Integrated Services Router Subscribe
1109-2p Integrated Services Router Subscribe
1109-4p Integrated Services Router Subscribe
1111x-8p Integrated Services Router Subscribe
4221 Integrated Services Router Subscribe
4331 Integrated Services Router Subscribe
4431 Integrated Services Router Subscribe
4461 Integrated Services Router Subscribe
Asr 1000-x Subscribe
Asr 1001-hx Subscribe
Asr 1002-hx Subscribe
Asr 1002-x Subscribe
Asr 1004 Subscribe
Asr 1006 Subscribe
Asr 1006-x Subscribe
Asr 1009-x Subscribe
Asr 1013 Subscribe
Csr1000v Subscribe
Ios Xe Subscribe
Ir1101 Subscribe
Nexus 56128p Subscribe
Nexus 5624q Subscribe
Nexus 5648q Subscribe
Nexus 5672up Subscribe
Nexus 5672up-16g Subscribe
Nexus 5696q Subscribe
Ucs-e1120d-m3 Subscribe
Ucs-e140s-m2 Subscribe
Ucs-e160d-m2 Subscribe
Ucs-e160s-m3 Subscribe
Ucs-e180d-m2 Subscribe
Ucs-e180d-m3 Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2019-10507 A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerability is due to the existence of default credentials within the default configuration of an affected device. An attacker who has access to an affected device could log in with elevated privileges. A successful exploit could allow the attacker to take complete control of the device. This vulnerability affects Cisco devices that are running Cisco IOS XE SD-WAN Software releases 16.11 and earlier.
Fixes

Solution

Cisco fixed this vulnerability in Cisco IOS XE SD-WAN Software Release 16.12.1.

Workaround

To check for the presence of default credentials, customers can use the show running-configuration | include username admin command within the Cisco IOS XE SD-WAN Software command line. To remove the default credentials, customers can use the config-transaction and no username admin commands.

References
Link Providers
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-cred-EVGSF259 cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2024-11-15T17:39:14.041Z

Reserved: 2018-12-06T00:00:00

Link: CVE-2019-1950

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-02-19T20:15:14.410

Modified: 2024-11-21T04:37:45.133

Link: CVE-2019-1950

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses