PT-2021-2987 · Cisco · Cisco Sd-Wan Vmanage

Alex Lumsden · Published 2021-05-05 · Updated 2023-10-16 · CVE-2021-1508

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the Cisco SD-WAN vManage Software, which could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information. Additionally, an authenticated, local attacker could gain escalated privileges or unauthorized access to the application. The vulnerability is also associated with inadequate access control in the vManage web interface, allowing a remote attacker to potentially elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Improper Access Control

RCE

Weakness Enumeration

CWE-862

CWE-284

CWE-20

Related Identifiers

BDU:2021-02574

CVE-2021-1508

Affected Products

Cisco Sd-Wan Vmanage

References · 5

• https://bdu.fstec.ru/vul/2021-02574 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1508 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1508 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-vmanage-4TbynnhZ · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2021050616 · Note