Cisco this week warned of two vulnerabilities that could allow an unauthenticated, remote attacker to gain access to the company’s SD-WAN software and appliances.

The vendor ranked the security flaws as "critical" in a security advisory released Wednesday. The two newly discovered flaws concern two attack vectors that could be used to trigger buffer overflow events.

The first vulnerability is the result of incorrect handling of IP traffic. “An attacker could exploit this vulnerability by sending crafted IP traffic through an affected device, which may cause a buffer overflow when the traffic is processed," Cisco explained in the advisory.

A successful exploitation of the vulnerability would allow an attacker to execute arbitrary code on the underlying operating system with root privileges.

Similarly, a second disclosed vulnerability warns of insufficient validation of user-supplied input when establishing a secure shell (SSH) connection. Cisco warns that by submitting a carefully crafted file to the system, an attacker could trigger a buffer overflow, resulting in a denial of service condition.

Devices and services affected by the vulnerabilities include both Cisco’s physical and cloud-based vEdge routers, IOS XE SD-WAN, the vBond SD-WAN orchestrator, vManage, and the vSmart SD-WAN controller.

There are currently no known workarounds, and Cisco encourages customers of affected devices and services to apply the latest security patches to address the vulnerability.