PT-2021-2833 · Cisco · Cisco Asa+1

Ilkin Gasimov · Published 2021-04-28 · Updated 2023-08-16 · CVE-2021-1476

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance Software (ASA) and Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description: The issue is related to insufficient input validation of commands supplied by the user in the CLI of the affected software. This could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root privileges. The attacker must have valid administrator-level credentials to exploit this issue.

Recommendations: To resolve the issue, update the software to a version that includes the fix for this problem. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2021-02379

CVE-2021-1476

Affected Products

Cisco Asa

Cisco Ftd

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-1476 · Security Note
• https://bdu.fstec.ru/vul/2021-02379 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-cmd-inj-SELprvG · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1476 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-cmd-inj-SELprvG · Vendor Advisory
• https://t.me/cvenotify/56632 · Telegram Post