VAR-202602-3258

Vulnerability from variot - Updated: 2026-03-04 23:22

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.

This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. . All information handled by the software may be rewritten. Furthermore, the software may stop working completely. Furthermore, attacks exploiting this vulnerability may affect other software as well

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202602-3258",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "catalyst sd-wan manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.12.5.3"
      },
      {
        "model": "catalyst sd-wan manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.13"
      },
      {
        "model": "sd-wan vsmart controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.11"
      },
      {
        "model": "sd-wan vsmart controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.16"
      },
      {
        "model": "catalyst sd-wan manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.15.4.2"
      },
      {
        "model": "sd-wan vsmart controller",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.9.8.2"
      },
      {
        "model": "sd-wan vsmart controller",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.18.2.1"
      },
      {
        "model": "catalyst sd-wan manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.11"
      },
      {
        "model": "catalyst sd-wan manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.16"
      },
      {
        "model": "catalyst sd-wan manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.12.6"
      },
      {
        "model": "sd-wan vsmart controller",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.12.5.3"
      },
      {
        "model": "sd-wan vsmart controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.13"
      },
      {
        "model": "sd-wan vsmart controller",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.12.6"
      },
      {
        "model": "sd-wan vsmart controller",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.15.4.2"
      },
      {
        "model": "catalyst sd-wan manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.9.8.2"
      },
      {
        "model": "catalyst sd-wan manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "20.18.2.1"
      },
      {
        "model": "cisco sd-wan vsmart controller",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "cisco catalyst sd-wan manager",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2026-005651"
      },
      {
        "db": "NVD",
        "id": "CVE-2026-20127"
      }
    ]
  },
  "cve": "CVE-2026-20127",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "psirt@cisco.com",
            "availabilityImpact": "HIGH",
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2026-20127",
            "impactScore": 6.0,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 10.0,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2026-20127",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "psirt@cisco.com",
            "id": "CVE-2026-20127",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2026-20127",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "CVE-2026-20127",
            "trust": 0.8,
            "value": "Critical"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2026-005651"
      },
      {
        "db": "NVD",
        "id": "CVE-2026-20127"
      },
      {
        "db": "NVD",
        "id": "CVE-2026-20127"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. \r\n\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root\u0026nbsp;user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.\u0026nbsp;. All information handled by the software may be rewritten. Furthermore, the software may stop working completely. Furthermore, attacks exploiting this vulnerability may affect other software as well",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2026-20127"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2026-005651"
      }
    ],
    "trust": 1.62
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2026-20127",
        "trust": 2.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2026-005651",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2026-005651"
      },
      {
        "db": "NVD",
        "id": "CVE-2026-20127"
      }
    ]
  },
  "id": "VAR-202602-3258",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.7837837999999999
  },
  "last_update_date": "2026-03-04T23:22:00.943000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Cisco\u00a0Catalyst\u00a0SD-WAN\u00a0Controller\u00a0Authentication\u00a0Bypass\u00a0Vulnerability",
        "trust": 0.8,
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2026-005651"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-287",
        "trust": 1.0
      },
      {
        "problemtype": "Inappropriate authentication (CWE-287) [ others ]",
        "trust": 0.8
      },
      {
        "problemtype": " Inappropriate authentication (CWE-287) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2026-005651"
      },
      {
        "db": "NVD",
        "id": "CVE-2026-20127"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2026-20127"
      },
      {
        "trust": 1.0,
        "url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-sdwan-rpa-ehchtzk"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2026-20127"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2026-005651"
      },
      {
        "db": "NVD",
        "id": "CVE-2026-20127"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2026-005651"
      },
      {
        "db": "NVD",
        "id": "CVE-2026-20127"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2026-03-02T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2026-005651"
      },
      {
        "date": "2026-02-25T17:25:29.477000",
        "db": "NVD",
        "id": "CVE-2026-20127"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2026-03-02T09:51:00",
        "db": "JVNDB",
        "id": "JVNDB-2026-005651"
      },
      {
        "date": "2026-02-26T16:20:02.187000",
        "db": "NVD",
        "id": "CVE-2026-20127"
      }
    ]
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cisco Systems Cisco\u00a0Catalyst\u00a0SD-WAN\u00a0Manager Vulnerabilities related to authentication in multiple products, such as",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2026-005651"
      }
    ],
    "trust": 0.8
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.