Vulnerability record · CVE-2019-1624 · published 20 June 2019

CVE-2019-1624: Cisco sd-wan command injection vulnerability

Cisco · Sd Wan

A vulnerability in the vManage web-based UI (Web UI) in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the vManage Web UI. A successful exploit could allow the attacker to execute commands with root privileges.

8.8 CVSS 3.0 High EPSS 4.3% · top 9.1% CWE-77 · Command injection

8.8CVSS 3.0 base score, v2 9.0

4.3%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Sd Wan Cisco

References

Link	Tags
http://www.securityfocus.com/bid/108845	Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-sdwan-cmdinj	Vendor Advisory
http://www.securityfocus.com/bid/108845	Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-sdwan-cmdinj	Vendor Advisory

Track CVE-2019-1624 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2022-20775Cisco SD-WAN CLI access control flaw allows root privilege escalationCisco SD-WAN Software has improper access controls on commands within the application CLI, letting an authenticated local attacker run a crafted comm…KEVEPSS 12%analysed30 Sep 2022 9.9CVE-2020-3374Cisco sd-wan improper authorization vulnerabilityA vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass author…EPSS 1.9%31 Jul 2020 9.8CVE-2020-3375Cisco sd-wan memory buffer overflow vulnerabilityA vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. T…EPSS 3.9%31 Jul 2020 9.8CVE-2018-15387Cisco sd-wan improper input validation vulnerabilityA vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device. …EPSS 1.1%5 Oct 2018 8.8CVE-2019-1650Cisco vedge 100 firmware improper input validation vulnerabilityA vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating s…EPSS 3.5%24 Jan 2019 8.1CVE-2023-20113Cisco sd-wan cross-site request forgery vulnerabilityA vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a c…EPSS 0.26%23 Mar 2023 8.0CVE-2019-1647Cisco sd-wan improper access control vulnerabilityA vulnerability in the Cisco SD-WAN Solution could allow an authenticated, adjacent attacker to bypass authentication and have direct unauthorized ac…EPSS 0.81%24 Jan 2019 7.8CVE-2022-20818Cisco sd-wan vbond orchestrator path traversal vulnerabilityMultiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerab…EPSS 0.63%30 Sep 2022

Source: NIST National Vulnerability Database (record CVE-2019-1624), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.