PT-2021-2984 · Cisco · Cisco Sd-Wan Vmanage

N.S · Published 2021-05-05 · Updated 2023-10-16 · CVE-2021-1468

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the software, which could allow an unauthenticated, remote attacker to execute arbitrary code, gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges. Specifically, the vulnerability in the messaging service of Cisco SD-WAN is associated with authentication errors, which could allow a remote attacker to create new administrative-level user accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Improper Authentication

Weakness Enumeration

CWE-20

CWE-287

Related Identifiers

BDU:2021-02571

CVE-2021-1468

Affected Products

Cisco Sd-Wan Vmanage

References · 5

• https://osv.dev/vulnerability/CVE-2021-1468 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02571 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1468 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-vmanage-4TbynnhZ · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2021050616 · Note