多款Cisco产品操作系统命令注入漏洞

🗓️ 24 Mar 2021 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 2 Views

在 Cisco IOS XE 的 rom monitor 中，启动脚本参数未正确验证，导致命令注入，可在系统启动时执行未签名代码。

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of the Cisco IOS ROM Monitor, which exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands, allows a perpetrator to execute arbitrary code during system bootup.	21 Apr 202100:00	–	bdu_fstec
Cisco	Cisco IOS XE ROM Monitor Software for Cisco Industrial Switches OS Command Injection Vulnerability	24 Mar 202116:00	–	cisco
Tenable Nessus	Cisco IOS XE Software ROM Monitor for Industrial Switches Command Injection (cisco-sa-iosxe-romvar-cmd-inj-N56fYbrw)	12 Apr 202100:00	–	nessus
CNVD	Cisco IOS XE OS Command Injection Vulnerability	25 Mar 202100:00	–	cnvd
CVE	CVE-2021-1452	24 Mar 202120:06	–	cve
Cvelist	CVE-2021-1452 Cisco IOS XE ROM Monitor Software for Cisco Industrial Switches OS Command Injection Vulnerability	24 Mar 202120:06	–	cvelist
EUVD	EUVD-2021-6919	3 Oct 202520:07	–	euvd
ICS	ICSA-21-110-02_Rockwell Automation Stratix Switches	20 Apr 202100:00	–	ics
NCSC	Vulnerabilities fixed in Cisco products	25 Mar 202100:00	–	ncsc
NVD	CVE-2021-1452	24 Mar 202120:15	–	nvd

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-1452
vigilance	www.vigilance.fr/vulnerability/Cisco-IOS-IOS-XE-multiple-vulnerabilities-34940
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2021042150
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-romvar-cmd-inj-N56fYbrw

24 May 2026 00:00Current

7High risk

Vulners AI Score7

CVSS 3.16.8

CVSS 27.2

EPSS0.00372

SSVC

Cisco IOS XE rom monitor command injection startup script unsigned code vulnerability