Recently, Cisco released a security report stating that it has resolved a critical unauthenticated REST API access vulnerability, vulnerability number CV-2023-20214 (cvss score 9.1). The vulnerability affects Cisco SDS-WAN management software, allowing attackers to launch remote attacks and gain read and write permissions on the device or restrict write permissions.
SD-WAN is a new solution launched in recent years and is becoming one of the future development trends. SD-WAN, that is, software-defined wide area network, is a service formed by applying SDN technology to wide area network scenarios. This service is used to connect enterprise networks, data centers, Internet applications and cloud services in a wide geographic range, aiming to help users reduce WAN expenses and increase network connection flexibility.
The Cisco Security Advisory states that the vulnerability is due to insufficient request validation when using other API features. An attacker could exploit this vulnerability by sending crafted API requests to an affected SD-WAN management device and obtain sensitive information from the device.
Cisco further emphasized that the vulnerability security flaw only affects other APIs, not the web-based management interface or CLI. Affected SD-WAN Management versions are as follows:
- v20.6.3.3 – fixed with the release v20.6.3.4
- v20.6.4 – fixed with the release v20.6.4.2
- v20.6.5 – fixed with the release v20.6.5.5
- v20.9 – fixed with the release v20.9.3.2
- v20.10 – fixed with the release v20.10.1.2
- v20.11 – fixed with the release v20.11.1.2
From the security report released by Cisco, we can know that SD-WAN management versions 20.7 and 20.8 will also be affected. For the updates of these versions, we recommend that users migrate to fixed versions.
Cisco recommends that enterprise network administrators reduce the attack surface by:
- Use Access Control Lists (ACLS) to restrict access to SD-WAN management instances;
- Use the API key to access the API;
- Check the logs to detect attempts to access other APIs.