CVE-2021-1514

CWE-20 — Improper Input ValidationCWE-78 — OS Command InjectionCWE-77 — Command Injection4 documents4 sources
Severity
7.8HIGH
EPSS
0.1%
top 78.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
14
Cisco Catalyst Sd-wan ManagerCisco Sd-wan Vbond OrchestratorCisco Sd-wan Vmanage+11 more
Timeline
PublishedMay 6
Latest updateMay 24

Description

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Administrator privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated as a low-privileged user to execute the affected command…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages14 packages

▶NVDcisco/vedge_100_firmware20.1 — 20.1.1+4
▶NVDcisco/vedge-100b_firmware20.1 — 20.1.1+4
▶NVDcisco/vedge_1000_firmware20.1 — 20.1.1+4
▶NVDcisco/vedge_100b_firmware20.1 — 20.1.1+4

🔴Vulnerability Details

2
GHSA
GHSA-rpjx-3g4c-xqfh: A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Admi↗2022-05-24
▶
CVEList
Cisco SD-WAN Software Privilege Escalation Vulnerability↗2021-05-06
▶

📋Vendor Advisories

1
Cisco
Cisco SD-WAN Software Privilege Escalation Vulnerability↗2021-05-05
▶