CVE-2021-1437
published 2021-03-24CVE-2021-1437: A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain…
PriorityP348high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.49%
71.3th percentile
A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device. This vulnerability is due to an unrestricted Trivial File Transfer Protocol (TFTP) configuration. An attacker could exploit this vulnerability by sending a specific TFTP request to an affected device. A successful exploit could allow the attacker to download any file from the filesystem of the affected access point (AP).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | aironet_access_points_flexconnect_upgrade | — | — |
| cisco | catalyst_9800_firmware | >= 17.1 < 17.3.3 | 17.3.3 |
| cisco | cisco_aironet_access_point_software | — | — |
| cisco | wireless_lan_controller_software | >= 8.10.112.0 < 8.10.142.0 | 8.10.142.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_cisco7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-777j-pmq7-4px5: A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to o
ghsa_unreviewed·2022-05-24
CVE-2021-1437 [HIGH] GHSA-777j-pmq7-4px5: A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to o
A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device. This vulnerability is due to an unrestricted Trivial File Transfer Protocol (TFTP) configuration. An attacker could exploit this vulnerability by sending a specific TFTP request to an affected device. A successful exploit could allow the attacker to download any file from the filesystem of the affected access point (AP).
Cisco
Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure Vulnerability
vendor_cisco·2021-03-24·CVSS 7.5
CVE-2021-1437 [HIGH] CWE-275 Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure Vulnerability
Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure Vulnerability
A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device.
This vulnerability is due to an unrestricted Trivial File Transfer Protocol (TFTP) configuration. An attacker could exploit this vulnerability by sending a specific TFTP request to an affected device. A successful exploit could allow the attacker to download any file from the filesystem of the affected access point (AP).
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:https://
Cisco
Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-1437 Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure Vulnerability
CVE-2021-1437: Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure Vulnerability
A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device. This vulnerability is due to an unrestricted Trivial File Transfer Protocol (TFTP) configuration. An attacker could exploit this vulnerability by sending a specific TFTP request to an affected device. A successful exploit could allow the attacker to download any file from the filesystem of the affected access point (AP). Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-275, CWE-275
Bug IDs: CSCvv91666
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-03-24
Published