cbcvebase.
CVE-2021-1531
published 2021-05-22

CVE-2021-1531: A vulnerability in the web UI of Cisco Modeling Labs could allow an authenticated, remote attacker to execute arbitrary commands with the privileges of the web…

PriorityP272high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
30.49%
98.0th percentile
A vulnerability in the web UI of Cisco Modeling Labs could allow an authenticated, remote attacker to execute arbitrary commands with the privileges of the web application on the underlying operating system of an affected Cisco Modeling Labs server. This vulnerability is due to insufficient validation of user-supplied input to the web UI. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected server. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the web application, virl2, on the underlying operating system of the affected server. To exploit this vulnerability, the attacker must have valid user credentials on the web UI.

Affected

8 ranges
VendorProductVersion rangeFixed in
ciscocisco_modeling_labs——
ciscomodeling_labs——
ciscomodeling_labs——
ciscomodeling_labs——
ciscomodeling_labs——
ciscomodeling_labs——
ciscomodeling_labs——
ciscomodeling_labs——

Detection & IOCsextracted from sources · hover to see the quote

  • →Exploit vector is a crafted HTTP request to the Cisco Modeling Labs web UI; monitor for anomalous or malformed HTTP requests targeting the CML web interface from authenticated sessions. ↗
  • →Commands executed on the underlying OS will run under the 'virl2' process/user account; alert on unexpected process execution or OS commands spawned by the virl2 web application user. ↗
  • →Root cause is CWE-88 (Argument Injection); focus detection on user-supplied input fields in the CML web UI that may be passed unsanitized to OS-level commands (argument injection pattern). ↗
  • →Exploitation requires valid authenticated credentials; investigate authenticated sessions that subsequently trigger unexpected system-level activity as a post-authentication abuse pattern. ↗
  • ·No workarounds are available for this vulnerability; patching via Cisco software updates is the only remediation path. ↗
  • ·The vulnerability is tracked under Cisco Bug ID CSCvx78835; use this identifier when querying Cisco's bug tracker or PSIRT feeds for patch status. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_cisco8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.