Cisco releases critical security alerts for DNA Center and SD-WAN software

Cisco alerts users to critical warnings in a dump of nearly 30 advisories

Cisco has released critical security alerts for its Digital Network Architecture (DNA) Center and SD-WAN software.

The vulnerability found in the company’s DNA Center software ranks high in severity, with a Common Vulnerability Scoring System (CVSS) rating of 9.3 out of 10. Cisco said the vulnerability allowed authenticated, adjacent attackers to bypass authentication and access critical internal services.

The vulnerability is due to insufficient access restriction to ports necessary for system operation, Cisco said, allowing an attacker to connect an unauthorised device and access the subnetwork designated for cluster services. If successful an attacker could reach internal services that are not hardened for external access.

DNA Center is Cisco’s centralised network control and management dashboard for Cisco DNA, the companies intent-based networking system. The software allows IT teams to define policies that control network access, automate provision, virtualise devices, and improve security through network segmentation and Encrypted Traffic Analysis. It’s basically the lynchpin of Cisco’s software-defined networking efforts.

Cisco discovered the exposure during testing. All DNA Software releases prior to 1.3 are vulnerable and there are no workarounds so the problem can only be fixed with a free software patch, accessible via the software’s System Updates section.

Another critical warning, with a 7.8 CVVS score, was discovered in Cisco’s SD-WAN solution.

SD-WAN refers to the application of software-defined networking (SDN) tech to wide area connections such as broadband, 4G, and soon 5G, extending enterprise networks over large distances that encompass branch offices and data centres.

The vulnerability is a privilege escalation flaw that allows a local attacker to rise from lower-level privileges to root via the SD-WAN software command line. A successful exploit allows the attacker to change the system’s configuration.

The vulnerability affects the following Cisco products running Cisco SD-WAN software prior to Releases 18.3.6, 18.4.1, and 19.1.0:

• vBond Orchestrator Software
• vEdge 100 Series Routers
• vEdge 1000 Series Routers
• vEdge 2000 Series Routers
• vEdge 5000 Series Routers
• vEdge Cloud Router Platform
• vManage Network Management Software
• vSmart Controller Software

Version 18.4.1 fixed the problem and is downloadable via the “Browse all” menu on the relevant products.

Cisco alerted users to the two critical warnings in a dump of nearly 30 security alerts.

Two others were of high severity and also involved the company’s SD-WAN solution, specifically Cisco’s vManage Network Management Software running the SD-WAN solution prior to Release 18.4.0.

The first is a privilege escalation flaw in the web interface of the software that allows an authenticated attacker to gain elevated privileges on a vManage device remotely. Another allows an authenticated attacker to remotely execute arbitrary commands. Both exposures have been patched with free software updates.