PT-2021-5012 · Cisco · Cisco Ios Xe Sd-Wan+1

Julien Legras · Published 2021-10-20 · Updated 2023-09-26 · CVE-2021-1529

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE SD-WAN Software (affected versions not specified)

Description A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the system CLI. An attacker could exploit this vulnerability by authenticating to an affected device and submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2021-05779

CVE-2021-1529

Affected Products

Cisco Ios Xe Sd-Wan

Cisco Ios Xe

References · 13

• https://bdu.fstec.ru/vul/2021-05779 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1529 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-rhpbE34A · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1529 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/670964 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-rhpbE34A · Vendor Advisory
• https://t.me/cibsecurity/31027 · Telegram Post
• https://t.me/true_secator/2247 · Telegram Post
• https://t.me/ckure/10031 · Telegram Post
• https://twitter.com/SystemTek_UK/status/1706609631143878918 · Twitter Post
• https://t.me/cvenotify/22424 · Telegram Post
• https://t.me/cvenotify/23656 · Telegram Post
• https://t.me/cibsecurity/30937 · Telegram Post