PT-2021-2834 · Cisco · Cisco Asa+1

Published 2021-04-28 · Updated 2023-08-16 · CVE-2021-1488

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description: A vulnerability in the upgrade process could allow an authenticated, local attacker to inject commands that could be executed with root privileges on the underlying operating system (OS). This issue is due to insufficient input validation. An attacker could exploit this vulnerability by uploading a crafted upgrade package file to an affected device. A successful exploit could allow the attacker to inject commands that could be executed with root privileges on the underlying OS.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2021-02380

CVE-2021-1488

Affected Products

Cisco Asa

Cisco Ftd

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-cmdinj-TKyQfDcU · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02380 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1488 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1488 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-cmdinj-TKyQfDcU · Vendor Advisory
• https://t.me/cvenotify/56631 · Telegram Post