CVE-2021-1529

CWE-78 — OS Command Injection4 documents4 sources
Severity
7.8HIGH
EPSS
0.0%
top 85.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco IOS XECisco Cisco IOS XE Sd-wan SoftwareCisco IOS XE Sd-wan
Timeline
PublishedOct 21
Latest updateMay 24

Description

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the system CLI. An attacker could exploit this vulnerability by authenticating to an affected device and submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root privileges.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶NVDcisco/ios_xe17.2 — 17.2.3+5

🔴Vulnerability Details

2
GHSA
GHSA-cg99-cxj5-wq75: A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with root privil↗2022-05-24
▶
CVEList
Cisco IOS XE SD-WAN Software Command Injection Vulnerability↗2021-10-21
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XE SD-WAN Software Command Injection Vulnerability↗2021-10-20
▶