Cisco Catalyst SD-WAN Manager (unpatched)
A network management platform that lets organisations centrally control and monitor their wide-area network (the system connecting offices, branches, and cloud services together).
Root Cause
The flaw exists in how the software validates (checks) incoming authentication requests. A gap in the validation logic allows a specially crafted request to bypass credential checks entirely, granting access without a valid username or password.
Attack Vector
An attacker sends a malformed authentication request to the SD-WAN Manager interface. The software, instead of rejecting it, processes it as legitimate. The attacker gains administrative access to the management plane (the control layer of the network) without needing any credentials. From there, they can reroute traffic, install backdoors (hidden access points), or pivot laterally (move through the network from one system to others) across the organisation's entire connected infrastructure.
Detection Notes
- Review SD-WAN Manager authentication logs for login events with no corresponding credential entry.
- Look for unexpected administrative sessions originating from external or unfamiliar IP addresses.
- Monitor for configuration changes made outside of normal change management windows.
Recommended Actions
- Apply Cisco's published mitigations immediately — restrict access to the SD-WAN Manager interface to trusted IP addresses only.
- Place the management interface behind a VPN (a private, encrypted network tunnel) if not already done.
- Enable detailed audit logging and alert on any new admin session creation.