PT-2021-2546 · Cisco · Cisco Sd-Wan Vmanage

Jakub Olszak + 1 · Published 2021-04-07 · Updated 2023-10-16 · CVE-2021-1137

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software (affected versions not specified)

Description: The issue is related to errors in access control, which could allow an attacker to modify any user account. It may also enable an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Improper Privilege Management

Weakness Enumeration

CWE-20

CWE-119

CWE-269

Related Identifiers

BDU:2021-01952

CVE-2021-1137

Affected Products

Cisco Sd-Wan Vmanage

References · 5

• https://osv.dev/vulnerability/CVE-2021-1137 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-YuTVWqy · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1137 · Security Note
• https://bdu.fstec.ru/vul/2021-01952 · Security Note
• https://t.me/cvenotify/12926 · Telegram Post