PT-2021-4720 · Cisco · Cisco Ios Xe+1

Paul Giblock · Published 2021-09-22 · Updated 2022-10-24 · CVE-2021-34729

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE SD-WAN Software (affected versions not specified) Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the CLI of the software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges on an affected device. This issue is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input in the argument of an affected command, potentially allowing the execution of arbitrary commands with elevated privileges on the underlying operating system. The attacker would need valid user credentials to exploit this vulnerability.

Recommendations For Cisco IOS XE SD-WAN Software, update to a version that includes the fix for this issue. For Cisco IOS XE Software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the CLI and limiting the use of affected commands until a patch is available.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2021-05426

CVE-2021-34729

Affected Products

Cisco Ios Xe Sd-Wan

Cisco Ios Xe

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-34729 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ioxesdwan-clicmdinj-7bYX5k3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34729 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05426 · Security Note
• https://t.me/cvenotify/21322 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021092415 · Note