PT-2021-2270 · Cisco · Cisco Asyncos

Hoangcuongflp · Published 2021-03-03 · Updated 2024-11-18 · CVE-2021-1425

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) (affected versions not specified)

Description: A vulnerability in the web-based management interface could allow an authenticated, remote attacker to access sensitive information on an affected device. The issue arises because confidential information is included in HTTP requests exchanged between the user and the device. An attacker could exploit this by examining the raw HTTP requests sent to the interface, potentially obtaining some configured passwords.

Recommendations: For Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), update to the latest software version that addresses this vulnerability. At the moment, there is no information about specific versions that contain a fix for this vulnerability.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

BDU:2021-01261

CVE-2021-1425

Affected Products

Cisco Asyncos

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-1425 · Security Note
• https://bdu.fstec.ru/vul/2021-01261 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-info-disclo-VOu2GHbZ · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1425 · Vendor Advisory
• https://twitter.com/CVEnew/status/1858538979207098837 · Twitter Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-info-disclo-VOu2GHbZ · Note