PT-2021-5130 · Cisco · Thousandeyes Recorder

Published 2021-06-02 · Updated 2021-06-14 · CVE-2021-1537

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco ThousandEyes Recorder (affected versions not specified)

Description The issue is related to insufficient protection of registration data in the installer software. An unauthenticated, local attacker could exploit this to access sensitive information contained in the ThousandEyes Recorder installer software. This is possible because sensitive information is included in the application installer. An attacker could exploit this by downloading the installer and extracting its contents, potentially allowing access to sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2021-05924

CVE-2021-1537

Affected Products

Thousandeyes Recorder

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-1537 · Security Note
• https://bdu.fstec.ru/vul/2021-05924 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1537 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-te-recorder-infodis-mx3ETTBM · Vendor Advisory
• https://t.me/cvenotify/15594 · Telegram Post
• https://t.me/cvenotify/16276 · Telegram Post