PT-2021-2986 · Cisco · Cisco Sd-Wan Vmanage

N.S · Published 2021-05-05 · Updated 2023-10-16 · CVE-2021-1506

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software (affected versions not specified)

Description The issue is related to multiple vulnerabilities in Cisco SD-WAN vManage Software that could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information. It could also allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application. Additionally, there is a vulnerability related to cluster mode that is associated with inadequate access control, which could allow a remote attacker to gain unauthorized access to services in the vulnerable system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Improper Access Control

RCE

Weakness Enumeration

CWE-862

CWE-284

CWE-20

Related Identifiers

BDU:2021-02573

CVE-2021-1506

Affected Products

Cisco Sd-Wan Vmanage

References · 6

• https://osv.dev/vulnerability/CVE-2021-1506 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02573 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1506 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-vmanage-4TbynnhZ · Vendor Advisory
• https://t.me/cvenotify/14440 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021050616 · Note