CVE-2019-12629

CVE-2019-12629 describes a command injection vulnerability in the WebUI of Cisco SD-WAN Solution products, including various vEdge models. An authenticated, remote attacker can exploit insufficient input validation by configuring a malicious username on the login page. This allows for the execution of arbitrary commands with vmanage user privileges, leading to a high severity CVSS score of 7.2. Despite its high severity, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion or media coverage.