Lucene search

CiscoCVE-2021-1383

HistoryMar 24, 2021 - 8:15 p.m.

CVE-2021-1383

2021-03-2420:15:13

CWE-88

CWE-20

cisco

web.nvd.nist.gov

cve-2021-1383

cisco

ios xe

sd-wan

software

cli

vulnerabilities

input validation

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with root privileges. These vulnerabilities are due to insufficient input validation of certain CLI commands. An attacker could exploit these vulnerabilities by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated as an administrative user to execute the affected commands. A successful exploit could allow the attacker to access the underlying operating system with root privileges.

Affected configurations

Nvd

Node

ciscoios_xeMatch16.9.1

ciscoios_xeMatch16.9.2

ciscoios_xeMatch16.9.3

ciscoios_xeMatch16.9.4

ciscoios_xeMatch16.10.1

ciscoios_xeMatch16.10.1a

ciscoios_xeMatch16.10.1b

ciscoios_xeMatch16.10.1c

ciscoios_xeMatch16.10.1d

ciscoios_xeMatch16.10.1e

ciscoios_xeMatch16.10.1f

ciscoios_xeMatch16.10.1g

ciscoios_xeMatch16.10.1s

ciscoios_xeMatch16.10.2

ciscoios_xeMatch16.10.3

ciscoios_xeMatch16.11.1

ciscoios_xeMatch16.11.1a

ciscoios_xeMatch16.11.1b

ciscoios_xeMatch16.11.1c

ciscoios_xeMatch16.11.1s

ciscoios_xeMatch16.11.2

ciscoios_xeMatch16.12.1

ciscoios_xeMatch16.12.1a

ciscoios_xeMatch16.12.1c

ciscoios_xeMatch16.12.1s

ciscoios_xeMatch16.12.1t

ciscoios_xeMatch16.12.1w

ciscoios_xeMatch16.12.1x

ciscoios_xeMatch16.12.1y

ciscoios_xeMatch16.12.1z

ciscoios_xeMatch16.12.1z1

ciscoios_xeMatch16.12.1za

ciscoios_xeMatch16.12.2

ciscoios_xeMatch16.12.2a

ciscoios_xeMatch16.12.2s

ciscoios_xeMatch16.12.2t

ciscoios_xeMatch16.12.3

ciscoios_xeMatch16.12.3a

ciscoios_xeMatch16.12.3s

ciscoios_xeMatch16.12.4

ciscoios_xeMatch16.12.4a

ciscoios_xeMatch16.12.5

ciscoios_xeMatch16.12.5b

ciscoios_xeMatch17.1.1

ciscoios_xeMatch17.1.1a

ciscoios_xeMatch17.1.1s

ciscoios_xeMatch17.1.1t

ciscoios_xeMatch17.1.2

ciscoios_xeMatch17.1.3

ciscoios_xeMatch17.2.1

ciscoios_xeMatch17.2.1a

ciscoios_xeMatch17.2.1r

ciscoios_xeMatch17.2.1v

ciscoios_xeMatch17.2.2

ciscoios_xeMatch17.3.1

ciscoios_xeMatch17.3.1a

ciscoios_xeMatch17.3.1w

ciscoios_xeMatch17.3.1x

ciscoios_xeMatch17.3.2

ciscoios_xeMatch17.3.2a

ciscoios_xeMatch17.4.1

ciscoios_xeMatch17.4.1a

ciscoios_xe_sd-wan

VendorProductVersionCPE
ciscoios_xe16.9.1cpe:2.3:o:cisco:ios_xe:16.9.1:*:*:*:*:*:*:*
ciscoios_xe16.9.2cpe:2.3:o:cisco:ios_xe:16.9.2:*:*:*:*:*:*:*
ciscoios_xe16.9.3cpe:2.3:o:cisco:ios_xe:16.9.3:*:*:*:*:*:*:*
ciscoios_xe16.9.4cpe:2.3:o:cisco:ios_xe:16.9.4:*:*:*:*:*:*:*
ciscoios_xe16.10.1cpe:2.3:o:cisco:ios_xe:16.10.1:*:*:*:*:*:*:*
ciscoios_xe16.10.1acpe:2.3:o:cisco:ios_xe:16.10.1a:*:*:*:*:*:*:*
ciscoios_xe16.10.1bcpe:2.3:o:cisco:ios_xe:16.10.1b:*:*:*:*:*:*:*
ciscoios_xe16.10.1ccpe:2.3:o:cisco:ios_xe:16.10.1c:*:*:*:*:*:*:*
ciscoios_xe16.10.1dcpe:2.3:o:cisco:ios_xe:16.10.1d:*:*:*:*:*:*:*
ciscoios_xe16.10.1ecpe:2.3:o:cisco:ios_xe:16.10.1e:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ios_xe	16.9.1	cpe:2.3:o:cisco:ios_xe:16.9.1:::::::*
cisco	ios_xe	16.9.2	cpe:2.3:o:cisco:ios_xe:16.9.2:::::::*
cisco	ios_xe	16.9.3	cpe:2.3:o:cisco:ios_xe:16.9.3:::::::*
cisco	ios_xe	16.9.4	cpe:2.3:o:cisco:ios_xe:16.9.4:::::::*
cisco	ios_xe	16.10.1	cpe:2.3:o:cisco:ios_xe:16.10.1:::::::*
cisco	ios_xe	16.10.1a	cpe:2.3:o:cisco:ios_xe:16.10.1a:::::::*
cisco	ios_xe	16.10.1b	cpe:2.3:o:cisco:ios_xe:16.10.1b:::::::*
cisco	ios_xe	16.10.1c	cpe:2.3:o:cisco:ios_xe:16.10.1c:::::::*
cisco	ios_xe	16.10.1d	cpe:2.3:o:cisco:ios_xe:16.10.1d:::::::*
cisco	ios_xe	16.10.1e	cpe:2.3:o:cisco:ios_xe:16.10.1e:::::::*

Rows per page:

1-10 of 631

CNA Affected

[
  {
    "product": "Cisco IOS XE Software",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

github.com/orangecertcc/security-research/security/advisories/GHSA-vw54-f9mw-g46r

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xesdwpinj-V4weeqzU

Social References

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-1383