PT-2021-2456 · Cisco · Cisco Ios Xe Sd-Wan+1

Cyrille Chatras · Published 2021-03-24 · Updated 2022-09-30 · CVE-2021-1382

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE SD-WAN Software (affected versions not specified)

Description: The issue exists due to insufficient input validation on certain CLI commands, allowing an authenticated, local attacker to inject arbitrary commands to be executed with root privileges on the underlying operating system. An attacker could exploit this by authenticating to the device and submitting crafted input to the CLI, requiring administrative user authentication to execute the affected commands. A successful exploit could allow the attacker to execute commands with root privileges.

Recommendations: For Cisco IOS XE SD-WAN Software, update to a version that includes the fix for this issue, as software updates have been released by Cisco to address this vulnerability. At the moment, there is no information about specific versions that contain a fix for this vulnerability.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2021-01821

CVE-2021-1382

GHSA-7XFM-92P7-QC57

Affected Products

Cisco Ios Xe Sd-Wan

Cisco Ios Xe

References · 6

• 🔥 https://github.com/orangecertcc/security-research/security/advisories/GHSA-7xfm-92p7-qc57 · Exploit
• https://osv.dev/vulnerability/CVE-2021-1382 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xesdwcinj-t68PPW7m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1382 · Security Note
• https://bdu.fstec.ru/vul/2021-01821 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xesdwcinj-t68PPW7m · Vendor Advisory