PT-2021-2506 · Cisco · Cisco Aironet Access Points

Chris Bellows + 1 · Published 2021-03-24 · Updated 2023-05-22 · CVE-2021-1423

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco Aironet Access Points (affected versions not specified)

Description The issue is related to insufficient input validation for a specific command in the implementation of a CLI command, which could allow an authenticated, local attacker to overwrite files in the flash memory of the device. An attacker could exploit this by issuing a command with crafted arguments, potentially allowing them to overwrite or create files with data already present in other files hosted on the affected device.

Recommendations For Cisco Aironet Access Points, consider restricting access to the vulnerable CLI command until a patch is available. As a temporary workaround, avoid using crafted arguments with specific commands to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2021-01882

CVE-2021-1423

Affected Products

Cisco Aironet Access Points

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-foverwrt-HyVXvrtb · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1423 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1423 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01882 · Security Note
• https://t.me/cvenotify/12387 · Telegram Post