VDB
CVE-2020-26066
CVE-2020-26066
PUBLISHED
CVSS 6.5 MEDIUM
A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by persuading a user to import a crafted XML file with malicious entries. A successful exploit could allow the attacker to read and write files within the affected application.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
EPSS 0.16% · 36.5th percentile
Risk Scores
CVSS 3.0
6.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:X/RL:X/RC:X
EPSS Score
0.16%
36.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Catalyst SD-WAN Manager | 20.1.12, 20.3.1, 19.2.929 |
| cisco | catalyst_sd-wan_manager | 18.4.1, 17.2.4, 17.2.5 |
| cisco | catalyst_sd-wan_manager | 20.1.12, 18.4.1, 18.4.4 |
Exploit Intelligence
- CIRCL seen: CVE-2020-26066 (circl-sighting)
- CIRCL seen: CVE-2020-26066 (circl-sighting)
- cisco-sa-vmanx3-vrZbOqqD (circl)
Timeline
- Nov 18, 2024 CVE Published
- Nov 18, 2024 PoC Published
- Nov 18, 2024 CVE Updated
- Nov 19, 2024 EPSS Score
- Dec 7, 2024 EPSS Score
- Dec 25, 2024 EPSS Score
- Jan 11, 2025 EPSS Score
- Jan 29, 2025 EPSS Score
- Feb 15, 2025 EPSS Score
- Mar 5, 2025 EPSS Score
- Mar 22, 2025 EPSS Score
- Apr 9, 2025 EPSS Score