CVE-2021-1398 — Active Debug Code in Cisco IOS XE Software

CWE-489 — Active Debug Code6 documents5 sources
Severity
6.8MEDIUMNVD
EPSS
0.1%
top 79.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOS XE SoftwareCisco IOS XE
Timeline
PublishedMar 24
Latest updateMay 24

Description

A vulnerability in the boot logic of Cisco IOS XE Software could allow an authenticated, local attacker with level 15 privileges or an unauthenticated attacker with physical access to execute arbitrary code on the underlying Linux operating system of an affected device. This vulnerability is due to incorrect validations of specific function arguments that are passed to the boot script. An attacker could exploit this vulnerability by tampering with a specific file, which an affected device would …

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 0.9 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/ios_xe257 versions+256

🔴Vulnerability Details

2
GHSA
GHSA-57gp-qx9r-6m7m: A vulnerability in the boot logic of Cisco IOS XE Software could allow an authenticated, local attacker with level 15 privileges or an unauthenticated↗2022-05-24
▶
CVEList
Cisco IOS XE Software Arbitrary Code Execution Vulnerability↗2021-03-24
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XE Software Arbitrary Code Execution Vulnerability↗2021-03-24
▶

🕵️Threat Intelligence

2
Talos
Vulnerability Spotlight: Use-after-free in Google Chrome could lead to code execution↗2022-02-07
▶
Talos
Vulnerability Spotlight: Use-after-free in Google Chrome could lead to code execution↗2022-02-07
▶
CVE-2021-1398 — Active Debug Code in Cisco | cvebase