PT-2021-7442 · Cisco · Cisco Common Services Platform Collector

Aaron Rhodes + 1 · Published 2021-06-02 · Updated 2021-06-14 · CVE-2021-1538

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Common Services Platform Collector (CSPC) (affected versions not specified)

Description A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to execute arbitrary code. This issue is due to insufficient sanitization of configuration entries. An attacker could exploit this vulnerability by logging in as a super admin and entering crafted input to configuration options on the CSPC configuration dashboard. A successful exploit could allow the attacker to execute remote code as root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-06335

CVE-2021-1538

Affected Products

Cisco Common Services Platform Collector

References · 6

• https://bdu.fstec.ru/vul/2022-06335 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1538 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CSPC-CIV-kDuBfNfu · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1538 · Security Note
• https://t.me/cvenotify/16278 · Telegram Post
• https://t.me/cvenotify/15593 · Telegram Post