CVE-2021-1479: Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated…

PriorityP264critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.93%

77.6th percentile

Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
cisco	catalyst_sd-wan_manager	>= 20.4 < 20.4.1	20.4.1
cisco	cisco_sd-wan_solution	—	—
cisco	sd-wan_vmanage	< 19.2.4	19.2.4
cisco	sd-wan_vmanage	—	—
cisco	sd-wan_vmanage	>= 19.3 < 20.3.3	20.3.3

Detection & IOCsextracted from sources · hover to see the quote

→CVE-2021-1479 affects Cisco SD-WAN vManage Software; track exploitation attempts targeting unauthenticated remote code execution vectors on vManage instances exposed to the internet ↗
→Reference Cisco Bug IDs CSCvs98509, CSCvv87918, and CSCvw08533 when correlating vendor patch telemetry or TAC cases to this CVE cluster ↗
→CWE-119 (buffer overflow/memory corruption) and CWE-269/CWE-250 (privilege escalation) are the underlying weakness classes; monitor for memory corruption exploitation patterns and unexpected privilege changes on vManage hosts ↗

·No workarounds are available for these vulnerabilities; the only remediation is applying Cisco-released software updates ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

vendor_cisco9.8CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.