Search
Find a vulnerability
Search criteria
9 vulnerabilities found for Catalyst SD-WAN by Cisco
GCVE-1988-2026-0280
Vulnerability from gna-1988 – Published: 2026-09-08 11:24 – Updated: 2026-09-11 11:37
VLAI
EPSS
VEX
Title
Cisco Catalyst SD-WAN C8000V Authenticated Heap Buffer Overflow
Summary
SUMMARY: an authenticated heap buffer overflow in cisco catalyst
c8000v sd-wan allows an attacker with low privileges to corrupt
process memory and achieve remote code execution by sending a crafted
message of type 0x0d (13) with device mode 5.
this was tested on 17.06.03 as it is the only image i had access to.
https://bst.cisco.com/quickview/bug/CSCwu48719
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-L4XfJg8S
===================== the vuln =====================
the core vuln is in vdaemon. vdaemon is the core control plane binary
used by catalyst to orchestrate stuff like secure tunneling and
joining new devices when they first are introduced to the sd-wan. thus
(again) its a juicy target to get initial access on.
the core vuln is at sub_2A4D0:
lea rdi, [r12+0F34h] ; peer struct
mov rbx, [rbp+src]
lea r15, [rbx+20h]
lea rsi, [rbx+24h]
mov edx, [rbx+20h]
call _memcpy
mov byte ptr [r14+rax+0F34h], 0 ; null term
the pseudocode, essenetially, is:
memcpy(&peer->f34h, msg->dat, msg->len);
peer->f34h[msg->len] = 0;
i assume you can see the major issue in here lol. we control the
length and src since we control the message. we get a heap buffer
overflow. in this case, we get two overflows:
; second overflow
lea rdi, [r12+0F86h]
lea rsi, [rbx+100h]
mov edx, [rbx+164h]
call _memcpy
mov byte ptr [r14+rax+0F86h], 0
this time to 0xf86 in peer.
peer is allocated in sub_21B20 once you xref it:
peer = (unsigned int *)((__int64 (__fastcall *)(__int64))g_mem)(0x1298);
so the peer struct is 4760 bytes large.
the peer struct looks like:
struct peer {
void *list_next;
void *list_prev;
uint8_t pad_10[16];
uint32_t peer_state;
uint32_t field_24;
uint8_t pad_28[14];
uint8_t flag_36;
uint8_t pad_37[101];
uint32_t msg_counter;
uint8_t pad_A0[232];
uint8_t addr_info[16];
uint8_t pad_198[161];
uint8_t tlv_block[128];
uint8_t pad_2B9[167];
uint8_t addr_data[56];
uint8_t field_398[24];
uint8_t pad_3B0[256];
void *conn_ptr;
struct timespec last_seen;
uint8_t pad_4C8[2668];
uint8_t vuln_buf_1[82]; // where we hit
uint8_t vuln_buf_2[106]; // where we hit again
uint8_t field_FF0[8];
char str_FF8[58];
uint8_t field_1032;
uint8_t pad_1033[12];
uint8_t field_103F;
uint8_t flag_1040;
uint8_t pad_1041[3];
uint32_t field_1044;
uint32_t field_1048;
uint8_t pad_104C[28];
void (*bev_ssl)(...); // funcptr HIT THIS HIT THIS
uint8_t pad_1070[48];
uint8_t field_10A0[128];
uint8_t field_1120[128];
char name1[41];
char name2[41];
uint8_t pad_11F2[14];
void *sub_obj;
uint8_t field_1208[144];
};
ideally, we could probably overflow the buffers to hit the function
ptr; put a stack pivot gadget then start ropping in the heap. later
versions of c8000v have pie + aslr obviously, so that would make
exploitation significantly harder but not impossible.
unforutnately the requirements to reach this heap bof mean that it
isnt preauth rce. youd still need a valid cert; but you could send a
message of type 13 (0x0D), or a REGISTER_TO_VMANAGE type, make the
device mode 5 (vManage device mode), then include your payload to hit
the sink.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Catalyst SD-WAN |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0280 (this record)
- possibly related CVE-2022-20775
{
"containers": {
"cna": {
"affected": [
{
"product": "Catalyst SD-WAN",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "evan"
}
],
"descriptions": [
{
"lang": "en",
"value": "SUMMARY: an authenticated heap buffer overflow in cisco catalyst\nc8000v sd-wan allows an attacker with low privileges to corrupt\nprocess memory and achieve remote code execution by sending a crafted\nmessage of type 0x0d (13) with device mode 5.\nthis was tested on 17.06.03 as it is the only image i had access to.\n\nhttps://bst.cisco.com/quickview/bug/CSCwu48719\n\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-L4XfJg8S\n\n===================== the vuln =====================\n\nthe core vuln is in vdaemon. vdaemon is the core control plane binary\nused by catalyst to orchestrate stuff like secure tunneling and\njoining new devices when they first are introduced to the sd-wan. thus\n(again) its a juicy target to get initial access on.\n\nthe core vuln is at sub_2A4D0:\n\nlea rdi, [r12+0F34h] ; peer struct\nmov rbx, [rbp+src]\nlea r15, [rbx+20h]\nlea rsi, [rbx+24h]\nmov edx, [rbx+20h]\ncall _memcpy\nmov byte ptr [r14+rax+0F34h], 0 ; null term\n\n\nthe pseudocode, essenetially, is:\n\nmemcpy(\u0026peer-\u003ef34h, msg-\u003edat, msg-\u003elen);\npeer-\u003ef34h[msg-\u003elen] = 0;\n\ni assume you can see the major issue in here lol. we control the\nlength and src since we control the message. we get a heap buffer\noverflow. in this case, we get two overflows:\n\n; second overflow\nlea rdi, [r12+0F86h]\nlea rsi, [rbx+100h]\nmov edx, [rbx+164h]\ncall _memcpy\nmov byte ptr [r14+rax+0F86h], 0\n\nthis time to 0xf86 in peer.\n\npeer is allocated in sub_21B20 once you xref it:\n\n peer = (unsigned int *)((__int64 (__fastcall *)(__int64))g_mem)(0x1298);\n\nso the peer struct is 4760 bytes large.\n\nthe peer struct looks like:\n\nstruct peer {\n void *list_next;\n void *list_prev;\n uint8_t pad_10[16];\n uint32_t peer_state;\n uint32_t field_24;\n uint8_t pad_28[14];\n uint8_t flag_36;\n uint8_t pad_37[101];\n uint32_t msg_counter;\n uint8_t pad_A0[232];\n uint8_t addr_info[16];\n uint8_t pad_198[161];\n uint8_t tlv_block[128];\n uint8_t pad_2B9[167];\n uint8_t addr_data[56];\n uint8_t field_398[24];\n uint8_t pad_3B0[256];\n void *conn_ptr;\n struct timespec last_seen;\n uint8_t pad_4C8[2668];\n uint8_t vuln_buf_1[82]; // where we hit\n uint8_t vuln_buf_2[106]; // where we hit again\n uint8_t field_FF0[8];\n char str_FF8[58];\n uint8_t field_1032;\n uint8_t pad_1033[12];\n uint8_t field_103F;\n uint8_t flag_1040;\n uint8_t pad_1041[3];\n uint32_t field_1044;\n uint32_t field_1048;\n uint8_t pad_104C[28];\n void (*bev_ssl)(...); // funcptr HIT THIS HIT THIS\n uint8_t pad_1070[48];\n uint8_t field_10A0[128];\n uint8_t field_1120[128];\n char name1[41];\n char name2[41];\n uint8_t pad_11F2[14];\n void *sub_obj;\n uint8_t field_1208[144];\n};\n\nideally, we could probably overflow the buffers to hit the function\nptr; put a stack pivot gadget then start ropping in the heap. later\nversions of c8000v have pie + aslr obviously, so that would make\nexploitation significantly harder but not impossible.\n\nunforutnately the requirements to reach this heap bof mean that it\nisnt preauth rce. youd still need a valid cert; but you could send a\nmessage of type 13 (0x0D), or a REGISTER_TO_VMANAGE type, make the\ndevice mode 5 (vManage device mode), then include your payload to hit\nthe sink.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:37:29Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/15"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/15"
},
{
"url": "https://bst.cisco.com/quickview/bug/CSCwu48719"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-L4XfJg8S"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/15"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Catalyst SD-WAN C8000V Authenticated Heap Buffer Overflow",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2022-20775",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0280",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/15",
"automated": true,
"contentSha256": "e5d5de9ca8d757d30bf04212990ac358c4d7b81fddaf34f8dc4596c3adf41025",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/15",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-06T14:08:27Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0280"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:24:56Z",
"dateUpdated": "2026-09-11T11:37:29Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0280"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0028
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:37
VLAI
EPSS
VEX
Title
Cisco Catalyst SD-WAN C8000V Authenticated Heap Buffer Overflow
Summary
SUMMARY: an authenticated heap buffer overflow in cisco catalyst
c8000v sd-wan allows an attacker with low privileges to corrupt
process memory and achieve remote code execution by sending a crafted
message of type 0x0d (13) with device mode 5.
this was tested on 17.06.03 as it is the only image i had access to.
https://bst.cisco.com/quickview/bug/CSCwu48719
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-L4XfJg8S
===================== the vuln =====================
the core vuln is in vdaemon. vdaemon is the core control plane binary
used by catalyst to orchestrate stuff like secure tunneling and
joining new devices when they first are introduced to the sd-wan. thus
(again) its a juicy target to get initial access on.
the core vuln is at sub_2A4D0:
lea rdi, [r12+0F34h] ; peer struct
mov rbx, [rbp+src]
lea r15, [rbx+20h]
lea rsi, [rbx+24h]
mov edx, [rbx+20h]
call _memcpy
mov byte ptr [r14+rax+0F34h], 0 ; null term
the pseudocode, essenetially, is:
memcpy(&peer->f34h, msg->dat, msg->len);
peer->f34h[msg->len] = 0;
i assume you can see the major issue in here lol. we control the
length and src since we control the message. we get a heap buffer
overflow. in this case, we get two overflows:
; second overflow
lea rdi, [r12+0F86h]
lea rsi, [rbx+100h]
mov edx, [rbx+164h]
call _memcpy
mov byte ptr [r14+rax+0F86h], 0
this time to 0xf86 in peer.
peer is allocated in sub_21B20 once you xref it:
peer = (unsigned int *)((__int64 (__fastcall *)(__int64))g_mem)(0x1298);
so the peer struct is 4760 bytes large.
the peer struct looks like:
struct peer {
void *list_next;
void *list_prev;
uint8_t pad_10[16];
uint32_t peer_state;
uint32_t field_24;
uint8_t pad_28[14];
uint8_t flag_36;
uint8_t pad_37[101];
uint32_t msg_counter;
uint8_t pad_A0[232];
uint8_t addr_info[16];
uint8_t pad_198[161];
uint8_t tlv_block[128];
uint8_t pad_2B9[167];
uint8_t addr_data[56];
uint8_t field_398[24];
uint8_t pad_3B0[256];
void *conn_ptr;
struct timespec last_seen;
uint8_t pad_4C8[2668];
uint8_t vuln_buf_1[82]; // where we hit
uint8_t vuln_buf_2[106]; // where we hit again
uint8_t field_FF0[8];
char str_FF8[58];
uint8_t field_1032;
uint8_t pad_1033[12];
uint8_t field_103F;
uint8_t flag_1040;
uint8_t pad_1041[3];
uint32_t field_1044;
uint32_t field_1048;
uint8_t pad_104C[28];
void (*bev_ssl)(...); // funcptr HIT THIS HIT THIS
uint8_t pad_1070[48];
uint8_t field_10A0[128];
uint8_t field_1120[128];
char name1[41];
char name2[41];
uint8_t pad_11F2[14];
void *sub_obj;
uint8_t field_1208[144];
};
ideally, we could probably overflow the buffers to hit the function
ptr; put a stack pivot gadget then start ropping in the heap. later
versions of c8000v have pie + aslr obviously, so that would make
exploitation significantly harder but not impossible.
unforutnately the requirements to reach this heap bof mean that it
isnt preauth rce. youd still need a valid cert; but you could send a
message of type 13 (0x0D), or a REGISTER_TO_VMANAGE type, make the
device mode 5 (vManage device mode), then include your payload to hit
the sink.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Catalyst SD-WAN |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Catalyst SD-WAN",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "evan"
}
],
"descriptions": [
{
"lang": "en",
"value": "SUMMARY: an authenticated heap buffer overflow in cisco catalyst\nc8000v sd-wan allows an attacker with low privileges to corrupt\nprocess memory and achieve remote code execution by sending a crafted\nmessage of type 0x0d (13) with device mode 5.\nthis was tested on 17.06.03 as it is the only image i had access to.\n\nhttps://bst.cisco.com/quickview/bug/CSCwu48719\n\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-L4XfJg8S\n\n===================== the vuln =====================\n\nthe core vuln is in vdaemon. vdaemon is the core control plane binary\nused by catalyst to orchestrate stuff like secure tunneling and\njoining new devices when they first are introduced to the sd-wan. thus\n(again) its a juicy target to get initial access on.\n\nthe core vuln is at sub_2A4D0:\n\nlea rdi, [r12+0F34h] ; peer struct\nmov rbx, [rbp+src]\nlea r15, [rbx+20h]\nlea rsi, [rbx+24h]\nmov edx, [rbx+20h]\ncall _memcpy\nmov byte ptr [r14+rax+0F34h], 0 ; null term\n\n\nthe pseudocode, essenetially, is:\n\nmemcpy(\u0026peer-\u003ef34h, msg-\u003edat, msg-\u003elen);\npeer-\u003ef34h[msg-\u003elen] = 0;\n\ni assume you can see the major issue in here lol. we control the\nlength and src since we control the message. we get a heap buffer\noverflow. in this case, we get two overflows:\n\n; second overflow\nlea rdi, [r12+0F86h]\nlea rsi, [rbx+100h]\nmov edx, [rbx+164h]\ncall _memcpy\nmov byte ptr [r14+rax+0F86h], 0\n\nthis time to 0xf86 in peer.\n\npeer is allocated in sub_21B20 once you xref it:\n\n peer = (unsigned int *)((__int64 (__fastcall *)(__int64))g_mem)(0x1298);\n\nso the peer struct is 4760 bytes large.\n\nthe peer struct looks like:\n\nstruct peer {\n void *list_next;\n void *list_prev;\n uint8_t pad_10[16];\n uint32_t peer_state;\n uint32_t field_24;\n uint8_t pad_28[14];\n uint8_t flag_36;\n uint8_t pad_37[101];\n uint32_t msg_counter;\n uint8_t pad_A0[232];\n uint8_t addr_info[16];\n uint8_t pad_198[161];\n uint8_t tlv_block[128];\n uint8_t pad_2B9[167];\n uint8_t addr_data[56];\n uint8_t field_398[24];\n uint8_t pad_3B0[256];\n void *conn_ptr;\n struct timespec last_seen;\n uint8_t pad_4C8[2668];\n uint8_t vuln_buf_1[82]; // where we hit\n uint8_t vuln_buf_2[106]; // where we hit again\n uint8_t field_FF0[8];\n char str_FF8[58];\n uint8_t field_1032;\n uint8_t pad_1033[12];\n uint8_t field_103F;\n uint8_t flag_1040;\n uint8_t pad_1041[3];\n uint32_t field_1044;\n uint32_t field_1048;\n uint8_t pad_104C[28];\n void (*bev_ssl)(...); // funcptr HIT THIS HIT THIS\n uint8_t pad_1070[48];\n uint8_t field_10A0[128];\n uint8_t field_1120[128];\n char name1[41];\n char name2[41];\n uint8_t pad_11F2[14];\n void *sub_obj;\n uint8_t field_1208[144];\n};\n\nideally, we could probably overflow the buffers to hit the function\nptr; put a stack pivot gadget then start ropping in the heap. later\nversions of c8000v have pie + aslr obviously, so that would make\nexploitation significantly harder but not impossible.\n\nunforutnately the requirements to reach this heap bof mean that it\nisnt preauth rce. youd still need a valid cert; but you could send a\nmessage of type 13 (0x0D), or a REGISTER_TO_VMANAGE type, make the\ndevice mode 5 (vManage device mode), then include your payload to hit\nthe sink.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:37:29Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/15"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/15"
},
{
"url": "https://bst.cisco.com/quickview/bug/CSCwu48719"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-L4XfJg8S"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/15"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Catalyst SD-WAN C8000V Authenticated Heap Buffer Overflow",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0028",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/15",
"automated": true,
"contentSha256": "e5d5de9ca8d757d30bf04212990ac358c4d7b81fddaf34f8dc4596c3adf41025",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/15",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-06T14:08:27Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:20Z",
"dateUpdated": "2026-09-11T11:37:29Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0028"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CERTFR-2026-AVI-0975
Vulnerability from certfr_avis - Published: 2026-08-06 - Updated: 2026-08-06
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | NFVIS | NFVIS versions 26.1.x antérieures à 26.1.2 | ||
| Cisco | UCS | UCS Server versions 4.3.x antérieures à 4.3 (6.260033 et 6.260054 pour C-Series M7 et M8 Rack Server) | ||
| Cisco | UCS | UCS Server versions 4.3.x antérieures à 4.3 (6.260054 pour C-Series M6 Rack Server) | ||
| Cisco | IOS XE | IOS XE versions 26.1.x antérieures à 26.1.2 | ||
| Cisco | UCS | UCS Server versions 4.3 antérieures à 4.3 (2.260020) | ||
| Cisco | IOS XE | IOS XE versions 17.9.x antérieures à 17.9.10 | ||
| Cisco | IOS XE | IOS XE versions 17.15.x antérieures à 17.15.6 | ||
| Cisco | UCS | UCSE versions antérieures à 3.2.18.1 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions 20.16.x à 20.18.x antérieures à 20.18.4 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions 20.10.x à 20.12.x antérieures à 20.12.8.1 | ||
| Cisco | NFVIS | NFVIS versions 4.13.x à 4.15.x et antérieures à 4.15.6 | ||
| Cisco | UCS | UCS Server versions 6.0 antérieures à 6.0 (2.260044 et 2.260143 pour C-Series M7 et M8 Rack Server) | ||
| Cisco | UCS | UCSE versions antérieures à 4.15.4 | ||
| Cisco | NFVIS | NFVIS versions 4.16.x à 4.18.x antérieures à 4.18.5 (disponible en septembre 2026) | ||
| Cisco | IOS XE | IOS XE versions 17.18 antérieures à 17.18.4 ou 17.18.4a | ||
| Cisco | UCS | UCS Server versions 4.3.x antérieures à 4.3 (2.260020 pour C-Series M5 Rack Server) | ||
| Cisco | NFVIS | NFVIS versions antérieures à 4.12.8 | ||
| Cisco | IOS XE | IOS XE versions 17.12.x antérieures à 17.12.8 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions antérieures à 20.9.10 | ||
| Cisco | UCS | UCS Server versions antérieures à 4.2 (3r) | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions 20.13.x à 20.15.x antérieures à 20.15.6 | ||
| Cisco | UCS | UCS Server versions 6.0 antérieures à 6.0 (2.260143 pour C-Series M6 Rack Server) | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions 26.1.x antérieures à 26.1.2 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NFVIS versions 26.1.x ant\u00e9rieures \u00e0 26.1.2",
"product": {
"name": "NFVIS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS Server versions 4.3.x ant\u00e9rieures \u00e0 4.3 (6.260033 et 6.260054 pour C-Series M7 et M8 Rack Server)",
"product": {
"name": "UCS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS Server versions 4.3.x ant\u00e9rieures \u00e0 4.3 (6.260054 pour C-Series M6 Rack Server)",
"product": {
"name": "UCS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE versions 26.1.x ant\u00e9rieures \u00e0 26.1.2",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS Server versions 4.3 ant\u00e9rieures \u00e0 4.3 (2.260020)",
"product": {
"name": "UCS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE versions 17.9.x ant\u00e9rieures \u00e0 17.9.10",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE versions 17.15.x ant\u00e9rieures \u00e0 17.15.6",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCSE versions ant\u00e9rieures \u00e0 3.2.18.1",
"product": {
"name": "UCS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions 20.16.x \u00e0 20.18.x ant\u00e9rieures \u00e0 20.18.4",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions 20.10.x \u00e0 20.12.x ant\u00e9rieures \u00e0 20.12.8.1",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "NFVIS versions 4.13.x \u00e0 4.15.x et ant\u00e9rieures \u00e0 4.15.6",
"product": {
"name": "NFVIS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS Server versions 6.0 ant\u00e9rieures \u00e0 6.0 (2.260044 et 2.260143 pour C-Series M7 et M8 Rack Server)",
"product": {
"name": "UCS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCSE versions ant\u00e9rieures \u00e0 4.15.4",
"product": {
"name": "UCS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "NFVIS versions 4.16.x \u00e0 4.18.x ant\u00e9rieures \u00e0 4.18.5 (disponible en septembre 2026)",
"product": {
"name": "NFVIS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE versions 17.18 ant\u00e9rieures \u00e0 17.18.4 ou 17.18.4a",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS Server versions 4.3.x ant\u00e9rieures \u00e0 4.3 (2.260020 pour C-Series M5 Rack Server)",
"product": {
"name": "UCS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "NFVIS versions ant\u00e9rieures \u00e0 4.12.8",
"product": {
"name": "NFVIS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE versions 17.12.x ant\u00e9rieures \u00e0 17.12.8",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions ant\u00e9rieures \u00e0 20.9.10",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS Server versions ant\u00e9rieures \u00e0 4.2 (3r)",
"product": {
"name": "UCS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions 20.13.x \u00e0 20.15.x ant\u00e9rieures \u00e0 20.15.6",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS Server versions 6.0 ant\u00e9rieures \u00e0 6.0 (2.260143 pour C-Series M6 Rack Server)",
"product": {
"name": "UCS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions 26.1.x ant\u00e9rieures \u00e0 26.1.2",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-20303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20303"
},
{
"name": "CVE-2026-20270",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20270"
},
{
"name": "CVE-2026-20312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20312"
},
{
"name": "CVE-2026-20267",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20267"
},
{
"name": "CVE-2026-20200",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20200"
},
{
"name": "CVE-2026-20271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20271"
},
{
"name": "CVE-2026-20269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20269"
},
{
"name": "CVE-2026-20288",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20288"
},
{
"name": "CVE-2026-20313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20313"
},
{
"name": "CVE-2026-20304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20304"
},
{
"name": "CVE-2026-20273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20273"
},
{
"name": "CVE-2026-20263",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20263"
},
{
"name": "CVE-2026-20301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20301"
},
{
"name": "CVE-2026-20124",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20124"
},
{
"name": "CVE-2026-20272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20272"
},
{
"name": "CVE-2026-20268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20268"
},
{
"name": "CVE-2026-20310",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20310"
}
],
"initial_release_date": "2026-08-06T00:00:00",
"last_revision_date": "2026-08-06T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0975",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-06T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxe-bing-MGHrFAkd",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-bing-MGHrFAkd"
},
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-cimc-arg-inject-upSHdMfU",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-arg-inject-upSHdMfU"
},
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxe-snmp-dos-ZAqNm4MD",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-snmp-dos-ZAqNm4MD"
},
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-hardening-iosxe-V8NMuMZJ",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ"
},
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ios-xmcp-thbAr34t",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xmcp-thbAr34t"
},
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-hardening-sdwan-faLcR3K",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K"
}
]
}
CERTFR-2026-AVI-0756
Vulnerability from certfr_avis - Published: 2026-06-16 - Updated: 2026-06-16
Une vulnérabilité a été découverte dans Cisco Catalyst. Elle permet à un attaquant de provoquer une atteinte à l'intégrité des données.
Cisco indique que la vulnérabilité CVE-2026-20262 est activement exploitée.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions 20.18.3 antérieures à 20.18.3.1 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions antérieures à 20.9.9.2 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions 20.15.5 antérieures à 20.15.5.3 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions 20.15.4 antérieures à 20.15.4.5 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions 20.12.7. antérieures à 20.12.7.2 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions 26.1.1 antérieures à 26.1.1.2 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Catalyst SD-WAN versions 20.18.3 ant\u00e9rieures \u00e0 20.18.3.1",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions ant\u00e9rieures \u00e0 20.9.9.2",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions 20.15.5 ant\u00e9rieures \u00e0 20.15.5.3",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions 20.15.4 ant\u00e9rieures \u00e0 20.15.4.5",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions 20.12.7. ant\u00e9rieures \u00e0 20.12.7.2",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions 26.1.1 ant\u00e9rieures \u00e0 26.1.1.2",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-20262",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20262"
}
],
"initial_release_date": "2026-06-16T00:00:00",
"last_revision_date": "2026-06-16T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0756",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-06-16T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Cisco Catalyst. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n\nCisco indique que la vuln\u00e9rabilit\u00e9 CVE-2026-20262 est activement exploit\u00e9e.",
"title": "Vuln\u00e9rabilit\u00e9 dans Cisco Catalyst",
"vendor_advisories": [
{
"published_at": "2026-06-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sdwan-arbfw-c2rZvQ",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ"
}
]
}
CERTFR-2026-AVI-0699
Vulnerability from certfr_avis - Published: 2026-06-05 - Updated: 2026-06-10
Une vulnérabilité a été découverte dans Cisco Catalyst SD-WAN. Elle permet à un attaquant de provoquer une élévation de privilèges.
Cisco indique que la vulnérabilité CVE-2026-20245 est activement exploitée.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN Manager versions antérieures à 20.18.3.1 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Catalyst SD-WAN Manager versions ant\u00e9rieures \u00e0 20.18.3.1",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-20245",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20245"
}
],
"initial_release_date": "2026-06-05T00:00:00",
"last_revision_date": "2026-06-10T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0699",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-06-05T00:00:00.000000"
},
{
"description": "Publication d\u0027un correctif par Cisco.",
"revision_date": "2026-06-10T00:00:00.000000"
}
],
"risks": [
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Cisco Catalyst SD-WAN. Elle permet \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.\n\nCisco indique que la vuln\u00e9rabilit\u00e9 CVE-2026-20245 est activement exploit\u00e9e.",
"title": "Vuln\u00e9rabilit\u00e9 dans Cisco Catalyst SD-WAN",
"vendor_advisories": [
{
"published_at": "2026-06-04",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sdwan-privesc-4uxFrdzx",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx"
}
]
}
CERTFR-2026-AVI-0210
Vulnerability from certfr_avis - Published: 2026-02-25 - Updated: 2026-02-25
De multiples vulnérabilités ont été découvertes dans Cisco Catalyst SD-WAN. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Cisco indique que la vulnérabilité CVE-2026-20127 est activement exploitée.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Cisco indique que la publication de la version corrective 20.9.8.2 pour Catalyst SD-WAN et Catalyst SD-WAN Manager est prévue le 27 février 2026. Les versions 20.11.x, 20.13.x, 20.14.x et 20.16.x sont affectées par les vulnérabilités mais ne bénéficieront pas de correctifs de sécurité car elles ont atteint la fin de période de maintenance. Le CERT-FR recommande de migrer vers une version maintenue et avec les derniers correctifs de sécurité.
L'éditeur précise aussi que la solution Cisco SD-WAN a été renommée Cisco Catalyst SD-WAN. Les avis éditeurs indiquent également d'autres changements de noms pour les composants de cette solution.
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN et Catalyst SD-WAN Manager versions antérieures à 20.9.8.2 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.12.6.x antérieures à 20.12.6.1 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.15.x antérieures à 20.15.4.2 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.18.x antérieures à 20.18.2.1 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.12.5.x antérieures à 20.12.5.3 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions ant\u00e9rieures \u00e0 20.9.8.2",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.12.6.x ant\u00e9rieures \u00e0 20.12.6.1",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.15.x ant\u00e9rieures \u00e0 20.15.4.2",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.18.x ant\u00e9rieures \u00e0 20.18.2.1",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN et Catalyst SD-WAN Manager versions 20.12.5.x ant\u00e9rieures \u00e0 20.12.5.3",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "Cisco indique que la publication de la version corrective 20.9.8.2 pour Catalyst SD-WAN et Catalyst SD-WAN Manager est pr\u00e9vue le 27 f\u00e9vrier 2026. Les versions 20.11.x, 20.13.x, 20.14.x et 20.16.x sont affect\u00e9es par les vuln\u00e9rabilit\u00e9s mais ne b\u00e9n\u00e9ficieront pas de correctifs de s\u00e9curit\u00e9 car elles ont atteint la fin de p\u00e9riode de maintenance. Le CERT-FR recommande de migrer vers une version maintenue et avec les derniers correctifs de s\u00e9curit\u00e9.\n\nL\u0027\u00e9diteur pr\u00e9cise aussi que la solution Cisco SD-WAN a \u00e9t\u00e9 renomm\u00e9e Cisco Catalyst SD-WAN. Les avis \u00e9diteurs indiquent \u00e9galement d\u0027autres changements de noms pour les composants de cette solution. ",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-20126",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20126"
},
{
"name": "CVE-2026-20128",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20128"
},
{
"name": "CVE-2026-20122",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20122"
},
{
"name": "CVE-2026-20129",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20129"
},
{
"name": "CVE-2026-20127",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20127"
},
{
"name": "CVE-2026-20133",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20133"
}
],
"initial_release_date": "2026-02-25T00:00:00",
"last_revision_date": "2026-02-25T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0210",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-02-25T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Cisco Catalyst SD-WAN. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n\nCisco indique que la vuln\u00e9rabilit\u00e9 CVE-2026-20127 est activement exploit\u00e9e.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Cisco Catalyst SD-WAN",
"vendor_advisories": [
{
"published_at": "2026-02-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sdwan-authbp-qwCX8D4v",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
},
{
"published_at": "2026-02-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sdwan-rpa-EHchtZk",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
}
]
}
CERTFR-2025-AVI-0378
Vulnerability from certfr_avis - Published: 2025-05-09 - Updated: 2025-05-09
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Catalyst Center | Catalyst Center versions antérieures à 2.3.7.9 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN Manager versions 20.13.x, 20.14.x et 20.15.x antérieures à 20.15.2 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN Manager versions 20.16.x antérieures à 20.16.1 | ||
| Cisco | IOS XR | IOS XR versions antérieures à 24.3.2 | ||
| Cisco | WLC AireOS | WLC AireOS versions antérieures à 8.10.196.0 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN Manager versions antérieures à 20.9.7 | ||
| Cisco | IOS XE | IOS XE : Se référer aux bulletins de sécurité de l'éditeur pour l'obtention des configurations vulnérables des équipements (cf. section Documentation). | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN Manager versions 20.10.x, 20.11.x et 20.12.x antérieures à 20.12.5 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Catalyst Center versions ant\u00e9rieures \u00e0 2.3.7.9",
"product": {
"name": "Catalyst Center",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN Manager versions 20.13.x, 20.14.x et 20.15.x ant\u00e9rieures \u00e0 20.15.2",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN Manager versions 20.16.x ant\u00e9rieures \u00e0 20.16.1",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR versions ant\u00e9rieures \u00e0 24.3.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "WLC AireOS versions ant\u00e9rieures \u00e0 8.10.196.0",
"product": {
"name": "WLC AireOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN Manager versions ant\u00e9rieures \u00e0 20.9.7",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE : Se r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des configurations vuln\u00e9rables des \u00e9quipements (cf. section Documentation).",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN Manager versions 20.10.x, 20.11.x et 20.12.x ant\u00e9rieures \u00e0 20.12.5",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-20189",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20189"
},
{
"name": "CVE-2025-20192",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20192"
},
{
"name": "CVE-2025-20199",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20199"
},
{
"name": "CVE-2025-20191",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20191"
},
{
"name": "CVE-2025-20188",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20188"
},
{
"name": "CVE-2025-20198",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20198"
},
{
"name": "CVE-2025-20181",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20181"
},
{
"name": "CVE-2025-20122",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20122"
},
{
"name": "CVE-2025-20202",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20202"
},
{
"name": "CVE-2025-20210",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20210"
},
{
"name": "CVE-2025-20162",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20162"
},
{
"name": "CVE-2025-20200",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20200"
},
{
"name": "CVE-2025-20154",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20154"
},
{
"name": "CVE-2025-20140",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20140"
},
{
"name": "CVE-2025-20201",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20201"
},
{
"name": "CVE-2025-20186",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20186"
},
{
"name": "CVE-2025-20182",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20182"
},
{
"name": "CVE-2025-20197",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20197"
},
{
"name": "CVE-2025-20164",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20164"
}
],
"initial_release_date": "2025-05-09T00:00:00",
"last_revision_date": "2025-05-09T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0378",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-05-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxe-ikev1-dos-XHk3HzFC",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-ikev1-dos-XHk3HzFC"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-twamp-kV4FHugn",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-twamp-kV4FHugn"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxe-privesc-su7scvdp",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-privesc-su7scvdp"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sisf-dos-ZGwt4DdY",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sisf-dos-ZGwt4DdY"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-webui-cmdinj-gVn3OKNC",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-cmdinj-gVn3OKNC"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ios-http-privesc-wCRd5e3",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-http-privesc-wCRd5e3"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-asr903-rsp3-arp-dos-WmfzdvJZ",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr903-rsp3-arp-dos-WmfzdvJZ"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ewlc-cdp-dos-fpeks9K",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-cdp-dos-fpeks9K"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-wlc-wncd-p6Gvt6HL",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-wncd-p6Gvt6HL"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-dnac-api-nBPZcJCM",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-api-nBPZcJCM"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-c2960-3560-sboot-ZtqADrHq",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c2960-3560-sboot-ZtqADrHq"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-multiprod-ikev2-dos-gPctUqv2",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multiprod-ikev2-dos-gPctUqv2"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sdwan-priviesc-WCk7bmmt",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-priviesc-WCk7bmmt"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-wlc-file-uplpd-rHZG9UfC",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-file-uplpd-rHZG9UfC"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxe-dhcpsn-dos-xBn8Mtks",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-dhcpsn-dos-xBn8Mtks"
}
]
}
CERTFR-2024-AVI-0813
Vulnerability from certfr_avis - Published: 2024-09-26 - Updated: 2024-09-26
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une injection de requêtes illégitimes par rebond (CSRF) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
L'éditeur indique que les versions 2.3.6.x de Catalyst Center sont également affectées par la vulnérabilité CVE-2024-20350 mais ne bénéficieront pas d'un correctif de sécurité.
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | IOS | IOs avec la fonctionnalité RSVP activée sans les derniers correctifs de sécurité (se référer au site de l'éditeur pour les versions affectées) | ||
| Cisco | Catalyst SD-WAN | 1000 Series Integrated Services Routers (ISRs), Catalyst 8000v Edge Software, Catalyst 8200 Series Edge Platforms, Catalyst 8300 Series Edge Platforms, Catalyst 8500L Edge Platforms, Catalyst IR8300 Rugged Series Routers avec la fonctionnalité UTD installée et activée, avec des tunnels SD-WAN configurés pour utiliser IPSec et sans les derniers correctifs de sécurité | ||
| Cisco | Catalyst Center | Catalyst Center versions 2.3.7.x antérieures à 2.3.7.5 | ||
| Cisco | IOS XE | IOS XE sans les derniers correctifs de sécurité (se référer au site de l'éditeur pour les versions affectées) | ||
| Cisco | Catalyst Center | Catalyst Center versions antérieures à 2.3.5.6 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IOs avec la fonctionnalit\u00e9 RSVP activ\u00e9e sans les derniers correctifs de s\u00e9curit\u00e9 (se r\u00e9f\u00e9rer au site de l\u0027\u00e9diteur pour les versions affect\u00e9es)",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "1000 Series Integrated Services Routers (ISRs), Catalyst 8000v Edge Software, Catalyst 8200 Series Edge Platforms, Catalyst 8300 Series Edge Platforms, Catalyst 8500L Edge Platforms, Catalyst IR8300 Rugged Series Routers avec la fonctionnalit\u00e9 UTD install\u00e9e et activ\u00e9e, avec des tunnels SD-WAN configur\u00e9s pour utiliser IPSec et sans les derniers correctifs de s\u00e9curit\u00e9",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst Center versions 2.3.7.x ant\u00e9rieures \u00e0 2.3.7.5",
"product": {
"name": "Catalyst Center",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE sans les derniers correctifs de s\u00e9curit\u00e9 (se r\u00e9f\u00e9rer au site de l\u0027\u00e9diteur pour les versions affect\u00e9es)",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst Center versions ant\u00e9rieures \u00e0 2.3.5.6",
"product": {
"name": "Catalyst Center",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "L\u0027\u00e9diteur indique que les versions 2.3.6.x de Catalyst Center sont \u00e9galement affect\u00e9es par la vuln\u00e9rabilit\u00e9 CVE-2024-20350 mais ne b\u00e9n\u00e9ficieront pas d\u0027un correctif de s\u00e9curit\u00e9. ",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-20480",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20480"
},
{
"name": "CVE-2024-20437",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20437"
},
{
"name": "CVE-2024-20455",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20455"
},
{
"name": "CVE-2024-20350",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20350"
},
{
"name": "CVE-2024-20464",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20464"
},
{
"name": "CVE-2024-20436",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20436"
},
{
"name": "CVE-2024-20433",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20433"
},
{
"name": "CVE-2024-20467",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20467"
}
],
"initial_release_date": "2024-09-26T00:00:00",
"last_revision_date": "2024-09-26T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0813",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-09-26T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2024-09-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-webui-csrf-ycUYxkKO",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-csrf-ycUYxkKO"
},
{
"published_at": "2024-09-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-pim-APbVfySJ",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pim-APbVfySJ"
},
{
"published_at": "2024-09-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-dnac-ssh-e4uOdASj",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ssh-e4uOdASj"
},
{
"published_at": "2024-09-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-rsvp-dos-OypvgVZf",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rsvp-dos-OypvgVZf"
},
{
"published_at": "2024-09-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ios-xe-sda-edge-dos-MBcbG9k",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sda-edge-dos-MBcbG9k"
},
{
"published_at": "2024-09-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sdwan-utd-dos-hDATqxs",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-utd-dos-hDATqxs"
},
{
"published_at": "2024-09-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-httpsrvr-dos-yOZThut",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-httpsrvr-dos-yOZThut"
},
{
"published_at": "2024-09-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-cpp-vfr-dos-nhHKGgO",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cpp-vfr-dos-nhHKGgO"
}
]
}
CERTFR-2026-ALE-002
Vulnerability from certfr_alerte - Published: 2026-02-25 - Updated: 2026-03-26
Une vulnérabilité a été découverte dans Cisco Catalyst SD-WAN. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Cisco indique que la vulnérabilité CVE-2026-20127 est activement exploitée.
Recherche de compromission
[Mise à jour du 26 février 2026]
Le CERT-FR recommande d'effectuer une recherche de compromission en s'appuyant sur les éléments documentés par Cisco dans son avis de sécurité et un billet de blogue [1] :
-
Vérification de la légitimité des événements d'appairage des connexions de contrôle (control connection peering events) :
-
Un exemple de journal est donné ci-dessous. Les valeurs associées à
peer-system-ipetpublic-ipdoivent correspondre à des valeurs attendues par rapport à l'architecture du système d'information et de la configuration SD-WAN. De plus lepeer-typedoit être cohérent avec l'équipement lié à l'adressepeer-system-ip. L'horodatage de l'événement doit être associé à des périodes de maintenance ou d'administration.
Jul 26 22:03:33 vSmart-01 VDAEMON_0[2571]: %Viptela-vSmart-VDAEMON_0-5-NTCE-1000001: control-connection-state-change new-state:up peer-type:vmanage peer-system-ip:1.1.1.10 public-ip:192.168.3.20 public-port:12345 domain-id:1 site-id:1005
-
En complément, le CERT-FR conseille de corréler les informations présentes dans ces événements pour identifier des schémas de reconnaissance ou des tentatives d’accès persistantes. Par exemple en regroupant les activités par
peer-typeetpeer-system-ip. Ces journaux peuvent être présents dans/var/log/tmplog/vdebug,/var/log/vsyslog,/var/log/jsyslogou/var/log/messages. -
Vérification de l'ajout d'une clé d'authentification SSH pour
vmanage-admin: -
Le compte
vmanage-adminest un compte légitime utilisé par le système. Les attaquants sont susceptibles d'avoir ajouté une clé SSH pour ce compte et de l'utiliser pour se connecter à l'équipement. - Il est nécessaire de valider que les événements d'authentification liée à l'utilisation d'une clé publique pour le compte
vmanage-adminpeuvent être reliés à une adresse IP connue et légitime. Ces événements sont notamment listés dans/var/log/auth.log. Un exemple de journal de ce type de connexion est présenté ci-dessous.
2026-02-10T22:51:36+00:00 vm sshd[804]: Accepted publickey for vmanage-admin from port [REDACTED PORT] ssh2: RSA SHA256:[REDACTED KEY]
-
La présence de clés inconnues dans
/home/vmanage-admin/.ssh/authorized_keys/est également un indicateur de compromission. -
Détection de rétrogradation de la version du système :
-
Les attaquants sont susceptibles d'avoir rétrogradé la version du système dans l'optique d'exploiter des vulnérabilités applicables à des versions antérieures, telle que la vulnérabilité CVE‑2022‑20775. La version système est par la suite restaurée.
- Les journaux suivants sont des indicateurs de rétrogradation :
Waiting for upgrade confirmation from user. Device will revert to previous software version in '100' seconds unless confirmed.
Software upgrade not confirmed. Reverting to previous software version
- La présence d'utilisateurs avec des noms anormaux et associés à des attaques de type traversée de chemin (path traversal) peut indiquer la tentative d'exploitation de la vulnérabilité CVE-2022-20775.
/../../et/\n&../\n&../sont des exemples de ce type d'attaque. -
Détection de journaux tronqués, effacés ou absents :
-
Les attaquants sont susceptibles d'avoir modifié les journaux pour rendre plus complexe la détection de leurs actions. La présence de journaux de taille anormalement faible (0, 1 ou 2 octets) est un indicateur de compromission.
- La modification et la suppression d'entrées dans les journaux suivants doivent aussi être vérifiées :
syslogwtmplastlogcli-historybash_history- journaux présents dans
/var/log/
-
Vérification des activités anormales de certains utilisateurs. Les éléments suivants doivent être étudiés :
-
Création, utilisation et suppression de comptes utilisateurs malveillants, y compris l’absence de
bash_historyet decli‑history; - Présence d’un fichier
cli‑historypour un utilisateur sans le bash history correspondant ; - Sessions root interactives sur des systèmes de production, avec des clés SSH non répertoriées, des known hosts et un historique bash. Par exemple :
- Clés SSH dans :
/home/root/.ssh/authorized_keysavecPermitRootLoginréglé suryesdans/etc/ssh/sshd_config - Known hosts dans :
/home/root/.ssh/known_hosts
Notification: system-login-change severity-level:minor host-name:"" system-ip: user-name:""root""
Cisco recommande également de consulter le guide de recherche de compromission rédigé par l'Australian Cyber Security Centre [2] ainsi que le guide de durcissement de Catalyst SD-WAN [3].
En cas de suspicion de compromission consulter les fiches réflexes de compromission d'un équipement de bordure réseau [4][5] et signaler l’événement auprès du CERT-FR.
Solutions
[Publication Initiale]
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Cisco indique que la publication de la version corrective 20.9.8.2 pour Catalyst SD-WAN est prévue le 27 février 2026. Les versions 20.11.x, 20.13.x, 20.14.x et 20.16.x sont affectées par la vulnérabilité mais ne bénéficieront pas de correctifs de sécurité car elles ont atteint la fin de période de maintenance. Le CERT-FR recommande de migrer vers une version maintenue et avec les derniers correctifs de sécurité.
L'éditeur précise aussi que la solution Cisco SD-WAN a été renommée Cisco Catalyst SD-WAN. L'avis éditeur indique également d'autres changements de noms pour les composants de cette solution.
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions 20.12.6.x antérieures à 20.12.6.1 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions antérieures à 20.9.8.2 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions 20.15.x antérieures à 20.15.4.2 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions 20.12.5.x antérieures à 20.12.5.3 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN versions 20.18.x antérieures à 20.18.2.1 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Catalyst SD-WAN versions 20.12.6.x ant\u00e9rieures \u00e0 20.12.6.1",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions ant\u00e9rieures \u00e0 20.9.8.2",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions 20.15.x ant\u00e9rieures \u00e0 20.15.4.2",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions 20.12.5.x ant\u00e9rieures \u00e0 20.12.5.3",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN versions 20.18.x ant\u00e9rieures \u00e0 20.18.2.1",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "Cisco indique que la publication de la version corrective 20.9.8.2 pour Catalyst SD-WAN est pr\u00e9vue le 27 f\u00e9vrier 2026. Les versions 20.11.x, 20.13.x, 20.14.x et 20.16.x sont affect\u00e9es par la vuln\u00e9rabilit\u00e9 mais ne b\u00e9n\u00e9ficieront pas de correctifs de s\u00e9curit\u00e9 car elles ont atteint la fin de p\u00e9riode de maintenance. Le CERT-FR recommande de migrer vers une version maintenue et avec les derniers correctifs de s\u00e9curit\u00e9.\n\nL\u0027\u00e9diteur pr\u00e9cise aussi que la solution Cisco SD-WAN a \u00e9t\u00e9 renomm\u00e9e Cisco Catalyst SD-WAN. L\u0027avis \u00e9diteur indique \u00e9galement d\u0027autres changements de noms pour les composants de cette solution. ",
"closed_at": "2026-03-26",
"content": "## Recherche de compromission\n\n\u003cspan class=\"important-content\"\u003e**[Mise \u00e0 jour du 26 f\u00e9vrier 2026]**\u003c/span\u003e\n\nLe CERT-FR recommande d\u0027effectuer une recherche de compromission en s\u0027appuyant sur les \u00e9l\u00e9ments document\u00e9s par Cisco dans son avis de s\u00e9curit\u00e9 et un billet de blogue [1] : \n\n1. V\u00e9rification de la l\u00e9gitimit\u00e9 des \u00e9v\u00e9nements d\u0027appairage des connexions de contr\u00f4le (*control connection peering events*) :\n \n* Un exemple de journal est donn\u00e9 ci-dessous. Les valeurs associ\u00e9es \u00e0 `peer-system-ip` et `public-ip` doivent correspondre \u00e0 des valeurs attendues par rapport \u00e0 l\u0027architecture du syst\u00e8me d\u0027information et de la configuration SD-WAN. De plus le `peer-type` doit \u00eatre coh\u00e9rent avec l\u0027\u00e9quipement li\u00e9 \u00e0 l\u0027adresse `peer-system-ip`. L\u0027horodatage de l\u0027\u00e9v\u00e9nement doit \u00eatre associ\u00e9 \u00e0 des p\u00e9riodes de maintenance ou d\u0027administration. \n\u003cpre\u003e\nJul 26 22:03:33 vSmart-01 VDAEMON_0[2571]: %Viptela-vSmart-VDAEMON_0-5-NTCE-1000001: control-connection-state-change new-state:up peer-type:vmanage peer-system-ip:1.1.1.10 public-ip:192.168.3.20 public-port:12345 domain-id:1 site-id:1005\n\u003c/pre\u003e\n* En compl\u00e9ment, le CERT-FR conseille de corr\u00e9ler les informations pr\u00e9sentes dans ces \u00e9v\u00e9nements pour identifier des sch\u00e9mas de reconnaissance ou des tentatives d\u2019acc\u00e8s persistantes. Par exemple en regroupant les activit\u00e9s par `peer-type` et `peer-system-ip`. Ces journaux peuvent \u00eatre pr\u00e9sents dans `/var/log/tmplog/vdebug`, `/var/log/vsyslog`, `/var/log/jsyslog` ou `/var/log/messages`.\n\n2. V\u00e9rification de l\u0027ajout d\u0027une cl\u00e9 d\u0027authentification SSH pour `vmanage-admin` :\n\n* Le compte `vmanage-admin` est un compte l\u00e9gitime utilis\u00e9 par le syst\u00e8me. Les attaquants sont susceptibles d\u0027avoir ajout\u00e9 une cl\u00e9 SSH pour ce compte et de l\u0027utiliser pour se connecter \u00e0 l\u0027\u00e9quipement. \n* Il est n\u00e9cessaire de valider que les \u00e9v\u00e9nements d\u0027authentification li\u00e9e \u00e0 l\u0027utilisation d\u0027une cl\u00e9 publique pour le compte `vmanage-admin` peuvent \u00eatre reli\u00e9s \u00e0 une adresse IP connue et l\u00e9gitime. Ces \u00e9v\u00e9nements sont notamment list\u00e9s dans `/var/log/auth.log`. Un exemple de journal de ce type de connexion est pr\u00e9sent\u00e9 ci-dessous.\n\u003cpre\u003e\n 2026-02-10T22:51:36+00:00 vm sshd[804]: Accepted publickey for vmanage-admin from port [REDACTED PORT] ssh2: RSA SHA256:[REDACTED KEY]\n\u003c/pre\u003e\n* La pr\u00e9sence de cl\u00e9s inconnues dans `/home/vmanage-admin/.ssh/authorized_keys/` est \u00e9galement un indicateur de compromission.\n\n3. D\u00e9tection de r\u00e9trogradation de la version du syst\u00e8me :\n\n* Les attaquants sont susceptibles d\u0027avoir r\u00e9trograd\u00e9 la version du syst\u00e8me dans l\u0027optique d\u0027exploiter des vuln\u00e9rabilit\u00e9s applicables \u00e0 des versions ant\u00e9rieures, telle que la vuln\u00e9rabilit\u00e9 CVE\u20112022\u201120775. La version syst\u00e8me est par la suite restaur\u00e9e.\n* Les journaux suivants sont des indicateurs de r\u00e9trogradation :\n\u003cpre\u003e\nWaiting for upgrade confirmation from user. Device will revert to previous software version \u003cversion\u003e in \u0027100\u0027 seconds unless confirmed.\n\u003c/pre\u003e\n\u003cpre\u003e\nSoftware upgrade not confirmed. Reverting to previous software version\n\u003c/pre\u003e\n* La pr\u00e9sence d\u0027utilisateurs avec des noms anormaux et associ\u00e9s \u00e0 des attaques de type travers\u00e9e de chemin (*path traversal*) peut indiquer la tentative d\u0027exploitation de la vuln\u00e9rabilit\u00e9 CVE-2022-20775. `/../../` et `/\\n\u0026../\\n\u0026../` sont des exemples de ce type d\u0027attaque. \n4. D\u00e9tection de journaux tronqu\u00e9s, effac\u00e9s ou absents :\n\n* Les attaquants sont susceptibles d\u0027avoir modifi\u00e9 les journaux pour rendre plus complexe la d\u00e9tection de leurs actions. La pr\u00e9sence de journaux de taille anormalement faible (0, 1 ou 2 octets) est un indicateur de compromission.\n* La modification et la suppression d\u0027entr\u00e9es dans les journaux suivants doivent aussi \u00eatre v\u00e9rifi\u00e9es : \n * `syslog`\n * `wtmp`\n * `lastlog`\n * `cli-history`\n * `bash_history`\n * journaux pr\u00e9sents dans `/var/log/`\n5. V\u00e9rification des activit\u00e9s anormales de certains utilisateurs. Les \u00e9l\u00e9ments suivants doivent \u00eatre \u00e9tudi\u00e9s :\n\n* Cr\u00e9ation, utilisation et suppression de comptes utilisateurs malveillants, y compris l\u2019absence de `bash_history` et de `cli\u2011history` ; \n* Pr\u00e9sence d\u2019un fichier `cli\u2011history` pour un utilisateur sans le bash history correspondant ; \n* Sessions root interactives sur des syst\u00e8mes de production, avec des cl\u00e9s SSH non r\u00e9pertori\u00e9es, des known hosts et un historique bash. Par exemple\u202f:\n * Cl\u00e9s SSH dans\u202f: `/home/root/.ssh/authorized_keys` avec `PermitRootLogin` r\u00e9gl\u00e9 sur `yes` dans`/etc/ssh/sshd_config`\n * Known hosts dans\u202f: `/home/root/.ssh/known_hosts`\n\u003cpre\u003e\nNotification: system-login-change severity-level:minor host-name:\"\u003cnode_name\u003e\" system-ip:\u003cIP\u003e user-name:\"\"root\"\"\n\u003c/pre\u003e\n\nCisco recommande \u00e9galement de consulter le guide de recherche de compromission r\u00e9dig\u00e9 par l\u0027Australian Cyber Security Centre [2] ainsi que le guide de durcissement de Catalyst SD-WAN [3].\n\nEn cas de suspicion de compromission consulter les fiches r\u00e9flexes de compromission d\u0027un \u00e9quipement de bordure r\u00e9seau [4][5] et signaler l\u2019\u00e9v\u00e9nement aupr\u00e8s du CERT-FR.\n\n## Solutions\n\n**[Publication Initiale]**\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-20127",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20127"
},
{
"name": "CVE-2022-20775",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20775"
}
],
"initial_release_date": "2026-02-25T00:00:00",
"last_revision_date": "2026-03-26T00:00:00",
"links": [
{
"title": "[3] Guide de durcissement de Catalyst SD-WAN",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide"
},
{
"title": "[2] Cisco SD-WAN Threat hunt guide, version 2.4 du 25 f\u00e9vrier 2026",
"url": "https://www.cyber.gov.au/sites/default/files/2026-02/ACSC-led%20Cisco%20SD-WAN%20Hunt%20Guide.pdf"
},
{
"title": "[1] Billet de blogue de Cisco Talos du 25 f\u00e9vrier 2026 relatif \u00e0 l\u0027exploitation de vuln\u00e9rabilit\u00e9s dans Catalyst SD-WAN",
"url": "https://blog.talosintelligence.com/uat-8616-sd-wan/"
},
{
"title": "[4] Compromission d\u0027un \u00e9quipement de bordure r\u00e9seau - Qualification",
"url": "https://www.cert.ssi.gouv.fr/fiche/CERTFR-2025-RFX-001/"
},
{
"title": "Avis CERTFR-2026-AVI-0210",
"url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0210/"
},
{
"title": "[5] Compromission d\u0027un \u00e9quipement de bordure r\u00e9seau - Endiguement",
"url": "https://www.cert.ssi.gouv.fr/fiche/CERTFR-2025-RFX-002/ "
}
],
"reference": "CERTFR-2026-ALE-002",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-02-25T00:00:00.000000"
},
{
"description": "Ajout de compl\u00e9ments li\u00e9s \u00e0 la recherche de compromission",
"revision_date": "2026-02-26T00:00:00.000000"
},
{
"description": " Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
"revision_date": "2026-03-26T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Cisco Catalyst SD-WAN. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n\nCisco indique que la vuln\u00e9rabilit\u00e9 CVE-2026-20127 est activement exploit\u00e9e.",
"title": "[M\u00e0J] Vuln\u00e9rabilit\u00e9 dans Cisco Catalyst SD-WAN",
"vendor_advisories": [
{
"published_at": "2026-02-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
}
]
}