PT-2021-2253 · Cisco · Cisco Sd-Wan Vmanage

Published 2021-03-03 · Updated 2025-08-04 · CVE-2021-1462

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software (affected versions not specified)

Description: A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system. The issue is due to incorrect privilege assignment and insufficient input validation. To exploit this vulnerability, an attacker would need to have a valid Administrator account on an affected system and create a malicious file that the system would parse later, potentially allowing the attacker to obtain root privileges.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-01226

CVE-2021-1462

Affected Products

Cisco Sd-Wan Vmanage

References · 7

• https://osv.dev/vulnerability/CVE-2021-1462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1462 · Security Note
• https://bdu.fstec.ru/vul/2021-01226 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-vman-kth3c82B · Vendor Advisory
• https://t.me/cveNotify/130773 · Telegram Post
• https://twitter.com/CVEnew/status/1858536022230884684 · Twitter Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-vman-kth3c82B · Note