Lucene search

[email protected]CVE-2021-1528

HistoryJun 04, 2021 - 5:15 p.m.

CVE-2021-1528

2021-06-0417:15:09

CWE-250

[email protected]

web.nvd.nist.gov

cisco

sd-wan

software

vulnerability

cli

authenticated

local attacker

elevated privileges

nvd

cve-2021-1528

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulnerability exists because the affected software does not properly restrict access to privileged processes. An attacker could exploit this vulnerability by invoking a privileged process in the affected system. A successful exploit could allow the attacker to perform actions with the privileges of the root user.

Affected configurations

NVD

Node

ciscocatalyst_sd-wan_managerRange20.4–20.4.2

ciscocatalyst_sd-wan_managerRange20.5–20.5.1

ciscosd-wan_vbond_orchestratorRange20.4–20.4.2

ciscosd-wan_vbond_orchestratorRange20.5–20.5.1

Node

ciscovsmart_controllerRange20.4–20.4.2

ciscovsmart_controllerRange20.5–20.5.1

Node

ciscovedge_100_firmwareRange20.4–20.4.2

ciscovedge_100_firmwareRange20.5–20.5.1

AND

ciscovedge_100Match-

Node

ciscovedge_1000_firmwareRange20.4–20.4.2

ciscovedge_1000_firmwareRange20.5–20.5.1

AND

ciscovedge_1000Match-

Node

ciscovedge_100b_firmwareRange20.4–20.4.2

ciscovedge_100b_firmwareRange20.5–20.5.1

AND

ciscovedge_100bMatch-

Node

ciscovedge_100m_firmwareRange20.4–20.4.2

ciscovedge_100m_firmwareRange20.5–20.5.1

AND

ciscovedge_100mMatch-

Node

ciscovedge_100wm_firmwareRange20.4–20.4.2

ciscovedge_100wm_firmwareRange20.5–20.5.1

AND

ciscovedge_100wmMatch-

Node

ciscovedge_2000_firmwareRange20.4–20.4.2

ciscovedge_2000_firmwareRange20.5–20.5.1

AND

ciscovedge_2000Match-

Node

ciscovedge_5000_firmwareRange20.4–20.4.2

ciscovedge_5000_firmwareRange20.5–20.5.1

AND

ciscovedge_5000Match-

Node

ciscovedge_100b_firmwareRange20.4–20.4.2

ciscovedge_100b_firmwareRange20.5–20.5.1

AND

ciscovedge_100bMatch-

Node

ciscovedge_cloud_firmwareRange20.4–20.4.2

ciscovedge_cloud_firmwareRange20.5–20.5.1

AND

ciscovedge_cloudMatch-

CPENameOperatorVersion
cisco:catalyst_sd-wan_managercisco catalyst sd-wan managerlt20.4.2
cisco:catalyst_sd-wan_managercisco catalyst sd-wan managerlt20.5.1
cisco:sd-wan_vbond_orchestratorcisco sd-wan vbond orchestratorlt20.4.2
cisco:sd-wan_vbond_orchestratorcisco sd-wan vbond orchestratorlt20.5.1

CPE	Name	Operator	Version
cisco:catalyst_sd-wan_manager	cisco catalyst sd-wan manager	lt	20.4.2
cisco:catalyst_sd-wan_manager	cisco catalyst sd-wan manager	lt	20.5.1
cisco:sd-wan_vbond_orchestrator	cisco sd-wan vbond orchestrator	lt	20.4.2
cisco:sd-wan_vbond_orchestrator	cisco sd-wan vbond orchestrator	lt	20.5.1

CNA Affected

[
  {
    "product": "Cisco SD-WAN Solution ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-fuErCWwF

Social References

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-1528

nessus1 cisco1 cvelist1 nvd1 prion1