PT-2021-2989 · Cisco · Cisco Asyncos

Jakub Bros · Published 2021-05-05 · Updated 2021-05-14 · CVE-2021-1447

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS for Cisco Content Security Management Appliance (affected versions not specified)

Description The issue is due to a procedural flaw in the password generation algorithm, allowing an authenticated, local attacker to elevate their privileges to root. An attacker could exploit this by enabling specific Administrator-only features and connecting to the appliance through the CLI with elevated privileges, potentially executing arbitrary commands as root and accessing the underlying operating system. The attacker must have valid Administrator credentials to exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2021-02577

CVE-2021-1447

Affected Products

Cisco Asyncos

References · 6

• https://osv.dev/vulnerability/CVE-2021-1447 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-priv-esc-JJ8zxQsC · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1447 · Security Note
• https://bdu.fstec.ru/vul/2021-02577 · Security Note
• https://t.me/cvenotify/14470 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021050612 · Note