One percent-encoded character gets an attacker admin API access to Cisco SD-WAN Manager

The mechanism, as the dev.to author reconstructs it, is two components disagreeing about what a request says ^[13]. The author says the reconstruction comes from the advisory's description, so the detail is inference and not Cisco's own text ^[13].

Here is the sequence the post describes. An authentication filter guards the j_security_check login-check path with a literal string match on the raw request URI ^[14]. The attacker sends %6a, the hex encoding of "j", in place of the letter ^[14]. The filter compares the still-encoded string to its rule, finds no match, and passes the request as one that needs no authentication ^[15]. The backend then decodes the URI before routing, sees the protected endpoint, and serves it as privileged ^[15].

The weakness class is CWE-177, improper handling of URL encoding ^[10]. The post argues these bugs recur because the fix is architectural: every layer that inspects a request must agree on its canonical form before any security decision is made ^[16]. It adds that such a flaw survives code review because each component looks correct in isolation ^[16]. In our view the ordering is the bug. Normalization has to run before the match, and a filter that matches first is wrong however clean its rule is.

The CVSS vector rates the attack as reachable over the network, low in complexity, and needing no privileges and no user interaction, with unchanged scope and high impact on confidentiality, integrity and availability, so the attack needs nothing from the victim ^[10]. The reach into branch devices comes from the post's own assessment. From admin API access, it says, an attacker "can push configuration to every branch router, harvest device credentials, alter routing policy to redirect traffic, or use the management network as a launchpad into the enterprise" ^[17]. Those are capabilities the author infers. The post cites no observed post-exploitation activity.

Cisco's advisory and CISA's listing landed on the same day, and the federal deadline gives agencies three days from listing ^[11]. The post also notes that cloud-hosted 20.15.605 was already fixed ^[8].