Cisco Catalyst SD-WAN Controller身份验证绕过漏洞(CVE-2026-20182)

详细信息

漏洞类型

授权问题

漏洞描述

Cisco Catalyst SD-WAN控制器(前称SD-WAN vSmart)和Cisco Catalyst SD-WAN管理器(前称SD-WAN vManage)中的对等认证存在漏洞，可能允许未经身份验证的远程攻击者绕过身份验证并在受影响系统上获得管理权限。该漏洞存在的原因是受影响系统中的对等认证机制未正常工作。攻击者可以通过向受影响系统发送精心构造的请求来利用此漏洞。成功利用此漏洞可能允许攻击者以内部高权限非根用户账户登录受影响的Cisco Catalyst SD-WAN控制器。使用该账户，攻击者可以访问NETCONF，从而允许攻击者操作SD-WAN网络构架的网络配置。

修复建议

Cisco已发布针对此漏洞的修复程序，参考链接： https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems

参考链接

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk

  CVE · Not Applicable

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW

  CVE · Vendor Advisory

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182

  NVD · US Government Resource

• https://nvd.nist.gov/vuln/detail/CVE-2026-20182

  CNNVD