CVE-2021-1542: Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following…

PriorityP346high8.1CVSS 3.1

AVNACHPRNUINSUCHIHAH

EPSS

1.39%

68.8th percentile

Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_small_business_220_series_smart_plus_switches	—	—
cisco	sf220-24_firmware	< 1.2.0.6	1.2.0.6
cisco	sf220-24p_firmware	< 1.2.0.6	1.2.0.6
cisco	sf220-48_firmware	< 1.2.0.6	1.2.0.6
cisco	sf220-48p_firmware	< 1.2.0.6	1.2.0.6
cisco	sg220-26_firmware	< 1.2.0.6	1.2.0.6
cisco	sg220-26p_firmware	< 1.2.0.6	1.2.0.6
cisco	sg220-28mp_firmware	< 1.2.0.6	1.2.0.6
cisco	sg220-50_firmware	< 1.2.0.6	1.2.0.6
cisco	sg220-50p_firmware	< 1.2.0.6	1.2.0.6
cisco	small_business_220_series_smart_switches	—	—

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C

vendor_cisco7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.