Cisco has issued five\u00a0 warnings about security weaknesses in its SD-WAN offerings, three of them on the high-end of the vulnerability scale.\nThe worst problem is with the command-line interface (CLI) of its SD-WAN Solution software where a weakness could let a local attacker inject arbitrary commands that are executed with root privileges, Cisco wrote.\n\nAn attacker could exploit this vulnerability \u2013 which has a 7.8 out if 10 on \u00a0the Common Vulnerability Scoring System \u2013 by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. The vulnerability is due to insufficient input validation, Cisco wrote.\nAnother high warning problem lets an authenticated, local attacker elevate privileges to root on the underlying operating system.\u00a0 An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain root-level privileges, Cisco wrote.\u00a0 The vulnerability is due to insufficient input validation.\nThe third high-level vulnerability in the SD-WAN Solution software could let an attacker cause a buffer overflow on an affected device. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to information that they are not authorized to access and make changes to the system that they are not authorized to make, Cisco wrote.\nThe vulnerabilities affect a number of Cisco products if they are running a Cisco SD-WAN Solution software release earlier than Release 19.2.2: vBond Orchestrator Software, vEdge 100-5000 Series Routers, vManage Network Management System and vSmart Controller Software.\nCisco said there were no workarounds for any of the vulnerabilities and it suggested users accept automatic software updates to allay exploit risks. There are software fixes for the problems as well.\u00a0\nAll three of the high-level warnings were reported to Cisco by the Orange Group, Cisco said.\nThe other two SD-WAN Solution software warnings \u2013 with medium threat levels -- include a one that allows a cross-site scripting (XSS) attack against the web-based management interface of the vManage software and SQL injection threat.\nThe XXS vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or to access sensitive, browser-based information.\nThe SQL vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could let the attacker \u00a0modify values on, or return values from, the underlying database as well as the operating system, Cisco wrote.\nCisco recognized Julien Legras and Thomas Etrillard of Synacktiv for reporting the problems.\nThe company said release 19.2.2 of the Cisco SD-WAN Solution contains fixes for all five vulnerabilities.