VULNERABILITY INTELLIGENCE

CVE-2019-16012

CVSS score8.1 HIGH
EPSS probability54.25%
CISA KEVNot currently listed
Published2020-03-19
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on, or return values from, the underlying database as well as the operating system.

Weakness classification

  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Primary references