PT-2021-2451 · Cisco · Cisco Aironet Series Access Points

Published 2021-03-24 · Updated 2023-05-22 · CVE-2021-1437

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Aironet Series Access Points Software (affected versions not specified)

Description: The issue is related to the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software, which is vulnerable due to an unrestricted Trivial File Transfer Protocol (TFTP) configuration. This could allow an unauthenticated, remote attacker to obtain confidential information from an affected device by sending a specific TFTP request. A successful exploit could allow the attacker to download any file from the filesystem of the affected access point (AP).

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-275

Related Identifiers

BDU:2021-01816

CVE-2021-1437

Affected Products

Cisco Aironet Series Access Points

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironet-info-disc-BfWqghj · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01816 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1437 · Security Note
• https://t.me/cvenotify/12398 · Telegram Post