PT-2021-2251 · Cisco · Cisco Network Services Orchestrator

Published 2021-03-03 · Updated 2025-08-05 · CVE-2021-1132

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Network Services Orchestrator (NSO) (affected versions not specified)

Description A vulnerability in the API subsystem and web-management interface of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to access sensitive data. This issue exists due to improper validation of user-supplied input in the web-management interface and certain HTTP-based APIs. An attacker could exploit this by sending a crafted HTTP request containing directory traversal character sequences to an affected system, potentially allowing access to sensitive files.

Recommendations For Cisco Network Services Orchestrator (NSO), update to a version that includes the software updates released by Cisco to address this vulnerability. As a temporary workaround, consider restricting access to the web-management interface and vulnerable API endpoints until a patch is available. Avoid using the vulnerable API subsystem and web-management interface until the issue is resolved. At the moment, there is no information about specific versions that contain a fix for this vulnerability.

Fix

Weakness Enumeration

CWE-35

Related Identifiers

BDU:2021-01224

CVE-2021-1132

Affected Products

Cisco Network Services Orchestrator

References · 12

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-rce-dos-U2PsSkz3 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vmaninfdis3-OvdR6uu8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1132 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwanvman-infodis1-YuQScHB · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1132 · Security Note
• https://bdu.fstec.ru/vul/2021-01224 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-path-trvsl-dZRQE8Lc · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-distupd-N87eB6Z3 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-ethernet-dos-HGXgJH8n · Vendor Advisory
• https://twitter.com/CVEnew/status/1858538963218411887 · Twitter Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-path-trvsl-dZRQE8Lc · Note
• https://t.me/cveNotify/130892 · Telegram Post