CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 7.2
CWE Name:  Permissions Privileges and Access Controls
Summary: a vulnerability in the user group configuration of the cisco sd-wan solution could allow an authenticated, local attacker to gain elevated privileges on an affected device. the vulnerability is due to a failure to properly validate certain parameters included within the group configuration. an attacker could exploit this vulnerability by writing a crafted file to the directory where the user group configuration is located in the underlying operating system. a successful exploit could allow the attacker to gain root-level privileges and take full control of the device.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-01-24
Last Modified Date: 2019-10-09