PT-2021-4678 · Cisco · Cisco Ios Xe Sd-Wan

Published 2021-09-22 · Updated 2021-09-30 · CVE-2021-1612

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE SD-WAN Software (affected versions not specified)

Description A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to overwrite arbitrary files on the local system. This issue is due to improper access controls on files within the local file system. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system, allowing them to overwrite arbitrary files on an affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-61

CWE-59

Related Identifiers

BDU:2021-05371

CVE-2021-1612

Affected Products

Cisco Ios Xe Sd-Wan

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-GjR5pGOm · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05371 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1612 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1612 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2021092420 · Note
• https://t.me/cibsecurity/29257 · Telegram Post