PT-2021-2505 · Cisco · Cisco Ios Xe

X.B · Published 2021-03-24 · Updated 2021-03-30 · CVE-2021-1390

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in one of the diagnostic test CLI commands could allow an authenticated, local attacker to execute arbitrary code on an affected device. The attacker would need to have valid user credentials at privilege level 15. This issue exists because the affected software permits modification of the run-time memory under specific circumstances. An attacker could exploit this by authenticating to the device and issuing a specific diagnostic test command at the CLI, potentially triggering a logic error that allows overwriting system memory locations and executing arbitrary code on the underlying Linux operating system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-123

Related Identifiers

BDU:2021-01881

CVE-2021-1390

Affected Products

Cisco Ios Xe

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-OFP-6Nezgn7b · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1390 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1390 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-OFP-6Nezgn7b · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01881 · Security Note