PT-2021-2863 · Cisco · Cisco Sd-Wan Vmanage

Julien Legras + 1 · Published 2021-04-21 · Updated 2025-08-04 · CVE-2021-1482

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software (affected versions not specified)

Description The issue is related to errors in the authorization procedure of the Cisco SD-WAN vManage web interface. It allows a remote attacker to gain unauthorized access to protected information by sending specially crafted HTTP requests. This is due to insufficient authorization checks. An attacker could exploit this by sending crafted HTTP requests to the web-based management interface, potentially bypassing authorization checking and gaining access to sensitive information.

Recommendations For Cisco SD-WAN vManage Software, update to a version that includes the software updates released by Cisco to address this issue. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.

Fix

RCE

Improper Authorization

Weakness Enumeration

CWE-20

CWE-285

Related Identifiers

BDU:2021-02416

CVE-2021-1482

Affected Products

Cisco Sd-Wan Vmanage

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-1482 · Security Note
• https://bdu.fstec.ru/vul/2021-02416 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-auth-bypass-Z3Zze5XC · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1482 · Vendor Advisory
• https://securitylab.ru/vulnerability/519176.php · Note
• https://t.me/cveNotify/130764 · Telegram Post
• https://twitter.com/CVEnew/status/1857476937297338482 · Twitter Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-auth-bypass-Z3Zze5XC · Note
• https://cybersecurity-help.cz/vdb/SB2021042201 · Note