Cisco bugs allow creating admin accounts, executing commands as root

Cisco has fixed critical SD-WAN vManage and HyperFlex HX software security flaws that could enable remote attackers to execute commands as root or create rogue admin accounts.

The company also issued security updates to address high and medium severity vulnerabilities in multiple other software products that allow attackers to execute arbitrary code remotely, escalate privileges, trigger denial of service conditions, and more on unpatched servers.

Cisco's Product Security Incident Response Team (PSIRT) said that it's not aware of active exploitation of these vulnerabilities in the wild.

Exploitable to inject commands and execute code remotely

Cisco SD-WAN vManage Software vulnerabilities patched today by Cisco could enable unauthenticated, remote attackers to execute arbitrary code or access sensitive information.

They could also be exploited locally by authenticated local attackers to gain escalated privileges or unauthorized access to an application vulnerable to attacks.

The Cisco HyperFlex HX Command Injection security bugs make it possible for remote attackers with no privileges on the targeted servers to perform command injection attacks.

In both cases, chaining the vulnerabilities is not required for successful exploitation, and the bugs are not dependent on one another.

Authentication or user interaction not required

The three security issues Cisco rated as critical (tracked as CVE-2021-1497, CVE-2021-1468, and CVE-2021-1505) received CVSS base scores of 9.1 up to 9.8/10:

• CVE-2021-1468: Cisco SD-WAN vManage Cluster Mode Unauthorized Message Processing Vulnerability
• CVE-2021-1505: Cisco SD-WAN vManage Cluster Mode Privilege Escalation Vulnerability
• CVE-2021-1497: Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability

The critical Cisco SD-WAN vManage bugs only affect software operating in a cluster, as Cisco explained.

"Customers can verify whether the software is operating in cluster mode by checking the Cisco SD-WAN vManage web-based management interface Administration > Cluster Management view," the company said.

Based on the CVSS online calculator info, they can all be exploited in low complexity attacks that don't require authentication or user interaction.

Last month, Cisco addressed another critical pre-authentication remote code execution (RCE) vulnerability impacting SD-WAN vManage that could enable threat actors to obtain root privileges on the underlying operating system.

Another pre-auth Cisco SD-WAN RCE vulnerability (CVE-2021-1300) allowing attackers to execute arbitrary code with root privileges was fixed in January, while two more critical pre-auth Cisco SD-WAN bugs were addressed in July 2020.