PT-2021-2859 · Cisco · Cisco Sd-Wan Vmanage

Julien Legras + 1 · Published 2021-04-21 · Updated 2025-08-04 · CVE-2021-1481

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software (affected versions not specified)

Description The issue is related to insufficient neutralization of special elements in data requests in the web-based management interface of Cisco SD-WAN vManage Software. This could allow a remote attacker to conduct Cypher query language injection attacks on an affected system, potentially obtaining sensitive information. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this by sending crafted HTTP requests to the interface of an affected system.

Recommendations For all affected versions, update to the latest software version that addresses this vulnerability, as released by Cisco. There are no workarounds that address this vulnerability. As a temporary measure, consider restricting access to the web-based management interface to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-943

Related Identifiers

BDU:2021-02408

CVE-2021-1481

Affected Products

Cisco Sd-Wan Vmanage

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2021-1481 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1481 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-auth-bypass-Z3Zze5XC · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02408 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-cql-inject-c7z9QqyB · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-cql-inject-c7z9QqyB · Note
• https://twitter.com/transilienceai/status/1857654290191421664 · Twitter Post
• https://securitylab.ru/vulnerability/519176.php · Note
• https://cybersecurity-help.cz/vdb/SB2021042201 · Note
• https://twitter.com/CVEnew/status/1857476935955206368 · Twitter Post
• https://twitter.com/transilienceai/status/1857654283690201297 · Twitter Post
• https://t.me/cveNotify/130763 · Telegram Post