PT-2021-3084 · Cisco · Cisco Evolved Programmable Network (Epn) Manager+1

Published 2021-05-19 · Updated 2021-05-27 · CVE-2021-1487

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure and Evolved Programmable Network (EPN) Manager (affected versions not specified)

Description The issue is related to insufficient validation of user-supplied input to the web-based management interface, which could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. This could enable the attacker to take control of the affected system, obtain and alter sensitive data, and affect the devices managed by the system by pushing arbitrary configuration files, retrieving device credentials, and causing a denial of service condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2021-02696

CVE-2021-1487

Affected Products

Cisco Prime Infrastructure

Cisco Evolved Programmable Network (Epn) Manager

References · 5

• https://osv.dev/vulnerability/CVE-2021-1487 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-cmd-inj-YU5e6tB3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1487 · Security Note
• https://bdu.fstec.ru/vul/2021-02696 · Security Note
• https://t.me/cvenotify/14882 · Telegram Post