Vulnerability record · CVE-2019-16012 · published 19 March 2020
CVE-2019-16012: Cisco SD-WAN vManage web UI SQL injection
Cisco · Sd Wan Firmware
The web UI of Cisco SD-WAN Solution vManage fails to properly validate SQL values, allowing an authenticated remote attacker to inject malicious SQL queries. Because the injected queries can reach the underlying database and operating system, this is a serious flaw in a management-plane component that controls the SD-WAN fabric.
Description
A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on, or return values from, the underlying database as well as the operating system.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Automated analysis
high priorityCVSS 8.1 with high confidentiality and integrity impact on a central SD-WAN management component, plus very high EPSS, outweighs the requirement for prior authentication.
What it is
The web UI of Cisco SD-WAN Solution vManage fails to properly validate SQL values, allowing an authenticated remote attacker to inject malicious SQL queries. Because the injected queries can reach the underlying database and operating system, this is a serious flaw in a management-plane component that controls the SD-WAN fabric.
Impact
A successful exploit lets the attacker modify or read values in the underlying database and potentially interact with the operating system, giving broad control over vManage data and the host it runs on.
Attack surface
Reached over the network through the vManage web UI; the attacker must first authenticate to the application, and no user interaction is required per the CVSS vector (AV:N/AC:L/PR:L/UI:N).
Exploitation
Not listed in CISA KEV and no public exploit references are provided, but EPSS is high at 0.54249 (99th percentile), indicating elevated likelihood of attempted exploitation.
What to do
- Apply the Cisco vendor advisory fix for vManage as the first action.
- Restrict network access to the vManage web UI to trusted management networks and jump hosts.
- Enforce least privilege on vManage accounts and audit for unnecessary authenticated users.
- Monitor and review database and OS-level activity on vManage hosts for unexpected changes.
Detection
- Inspect vManage web and database logs for SQL metacharacters or malformed query patterns in user-supplied input.
- Alert on unexpected database writes or schema changes originating from the vManage web application.
- Baseline and monitor authenticated vManage sessions for anomalous query volume or unusual endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-16012 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-16012), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
