PT-2021-1953 · Cisco · Cisco Smart Software Manager Satellite+1

Published 2021-01-20 · Updated 2022-09-20 · CVE-2021-1139

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Smart Software Manager On-Prem (affected versions not specified) Cisco Smart Software Manager Satellite (affected versions not specified)

Description The issue is related to insufficient input validation in the web interface of the software, which could allow a remote attacker to execute arbitrary commands on the underlying operating system with root privileges.

Recommendations For Cisco Smart Software Manager On-Prem, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco Smart Software Manager Satellite, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

BDU:2021-00759

CVE-2021-1139

Affected Products

Cisco Smart Software Manager On-Prem

Cisco Smart Software Manager Satellite

References · 5

• https://bdu.fstec.ru/vul/2021-00759 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-multici-pgG5WM5A · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1139 · Security Note
• https://t.me/cibsecurity/22473 · Telegram Post