Lucene search
CiscoCVE-2021-1442HistoryMar 24, 2021 - 8:15 p.m.
CVE-2021-1442
2021-03-2420:15:15
CWE-532
cisco
web.nvd.nist.gov
40
cve-2021-1442
cisco
ios xe
software
vulnerability
pnp
subsystem
diagnostic command
authenticated
local attacker
privilege escalation
nvd
CVSS2
6.9
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
7.7
Confidence
High
EPSS
0
Percentile
5.1%
A vulnerability in a diagnostic command for the Plug-and-Play (PnP) subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to the level of an Administrator user (level 15) on an affected device. The vulnerability is due to insufficient protection of sensitive information. An attacker with low privileges could exploit this vulnerability by issuing the diagnostic CLI show pnp profile when a specific PnP listener is enabled on the device. A successful exploit could allow the attacker to obtain a privileged authentication token. This token can be used to send crafted PnP messages and execute privileged commands on the targeted system.
Affected configurations
Node
ciscoios_xeMatch3.6.3e
ORciscoios_xeMatch3.6.4e
ORciscoios_xeMatch3.6.5ae
ORciscoios_xeMatch3.6.5be
ORciscoios_xeMatch3.6.5e
ORciscoios_xeMatch3.6.6e
ORciscoios_xeMatch3.6.7ae
ORciscoios_xeMatch3.6.7be
ORciscoios_xeMatch3.6.7e
ORciscoios_xeMatch3.6.8e
ORciscoios_xeMatch3.6.9ae
ORciscoios_xeMatch3.6.9e
ORciscoios_xeMatch3.6.10e
ORciscoios_xeMatch3.7.3e
ORciscoios_xeMatch3.7.4e
ORciscoios_xeMatch3.7.5e
ORciscoios_xeMatch3.8.0e
ORciscoios_xeMatch3.8.1e
ORciscoios_xeMatch3.8.2e
ORciscoios_xeMatch3.8.3e
ORciscoios_xeMatch3.8.4e
ORciscoios_xeMatch3.8.5ae
ORciscoios_xeMatch3.8.5e
ORciscoios_xeMatch3.8.6e
ORciscoios_xeMatch3.8.7e
ORciscoios_xeMatch3.8.8e
ORciscoios_xeMatch3.8.9e
ORciscoios_xeMatch3.8.10e
ORciscoios_xeMatch3.9.0e
ORciscoios_xeMatch3.9.1e
ORciscoios_xeMatch3.9.2be
ORciscoios_xeMatch3.9.2e
ORciscoios_xeMatch3.10.0ce
ORciscoios_xeMatch3.10.0e
ORciscoios_xeMatch3.10.1ae
ORciscoios_xeMatch3.10.1e
ORciscoios_xeMatch3.10.1se
ORciscoios_xeMatch3.10.2e
ORciscoios_xeMatch3.10.3e
ORciscoios_xeMatch3.11.0e
ORciscoios_xeMatch3.11.1ae
ORciscoios_xeMatch3.11.1e
ORciscoios_xeMatch3.11.2ae
ORciscoios_xeMatch3.11.2e
ORciscoios_xeMatch3.13.8s
ORciscoios_xeMatch3.13.9s
ORciscoios_xeMatch3.13.10s
ORciscoios_xeMatch3.16.0as
ORciscoios_xeMatch3.16.0bs
ORciscoios_xeMatch3.16.0cs
ORciscoios_xeMatch3.16.0s
ORciscoios_xeMatch3.16.1as
ORciscoios_xeMatch3.16.1s
ORciscoios_xeMatch3.16.2as
ORciscoios_xeMatch3.16.2bs
ORciscoios_xeMatch3.16.2s
ORciscoios_xeMatch3.16.3as
ORciscoios_xeMatch3.16.3s
ORciscoios_xeMatch3.16.4as
ORciscoios_xeMatch3.16.4bs
ORciscoios_xeMatch3.16.4cs
ORciscoios_xeMatch3.16.4ds
ORciscoios_xeMatch3.16.4es
ORciscoios_xeMatch3.16.4gs
ORciscoios_xeMatch3.16.4s
ORciscoios_xeMatch3.16.5as
ORciscoios_xeMatch3.16.5bs
ORciscoios_xeMatch3.16.5s
ORciscoios_xeMatch3.16.6bs
ORciscoios_xeMatch3.16.6s
ORciscoios_xeMatch3.16.7as
ORciscoios_xeMatch3.16.7bs
ORciscoios_xeMatch3.16.7s
ORciscoios_xeMatch3.16.8s
ORciscoios_xeMatch3.16.9s
ORciscoios_xeMatch3.16.10as
ORciscoios_xeMatch3.16.10s
ORciscoios_xeMatch3.17.0s
ORciscoios_xeMatch3.17.1as
ORciscoios_xeMatch3.17.1s
ORciscoios_xeMatch3.17.2s
ORciscoios_xeMatch3.17.3s
ORciscoios_xeMatch3.17.4s
ORciscoios_xeMatch3.18.0as
ORciscoios_xeMatch3.18.0s
ORciscoios_xeMatch3.18.0sp
ORciscoios_xeMatch3.18.1asp
ORciscoios_xeMatch3.18.1bsp
ORciscoios_xeMatch3.18.1csp
ORciscoios_xeMatch3.18.1gsp
ORciscoios_xeMatch3.18.1hsp
ORciscoios_xeMatch3.18.1isp
ORciscoios_xeMatch3.18.1s
ORciscoios_xeMatch3.18.1sp
ORciscoios_xeMatch3.18.2asp
ORciscoios_xeMatch3.18.2s
ORciscoios_xeMatch3.18.2sp
ORciscoios_xeMatch3.18.3asp
ORciscoios_xeMatch3.18.3bsp
ORciscoios_xeMatch3.18.3s
ORciscoios_xeMatch3.18.3sp
ORciscoios_xeMatch3.18.4s
ORciscoios_xeMatch3.18.4sp
ORciscoios_xeMatch3.18.5sp
ORciscoios_xeMatch3.18.6sp
ORciscoios_xeMatch3.18.7sp
ORciscoios_xeMatch3.18.8asp
ORciscoios_xeMatch3.18.8sp
ORciscoios_xeMatch16.1.1
ORciscoios_xeMatch16.1.2
ORciscoios_xeMatch16.1.3
ORciscoios_xeMatch16.2.1
ORciscoios_xeMatch16.2.2
ORciscoios_xeMatch16.3.1
ORciscoios_xeMatch16.3.1a
ORciscoios_xeMatch16.3.2
ORciscoios_xeMatch16.3.3
ORciscoios_xeMatch16.3.4
ORciscoios_xeMatch16.3.5
ORciscoios_xeMatch16.3.5b
ORciscoios_xeMatch16.3.6
ORciscoios_xeMatch16.3.7
ORciscoios_xeMatch16.3.8
ORciscoios_xeMatch16.3.9
ORciscoios_xeMatch16.3.10
ORciscoios_xeMatch16.3.11
ORciscoios_xeMatch16.4.1
ORciscoios_xeMatch16.4.2
ORciscoios_xeMatch16.4.3
ORciscoios_xeMatch16.5.1
ORciscoios_xeMatch16.5.1a
ORciscoios_xeMatch16.5.1b
ORciscoios_xeMatch16.5.2
ORciscoios_xeMatch16.5.3
ORciscoios_xeMatch16.6.1
ORciscoios_xeMatch16.6.2
ORciscoios_xeMatch16.6.3
ORciscoios_xeMatch16.6.4
ORciscoios_xeMatch16.6.4a
ORciscoios_xeMatch16.6.4s
ORciscoios_xeMatch16.6.5
ORciscoios_xeMatch16.6.5a
ORciscoios_xeMatch16.6.5b
ORciscoios_xeMatch16.6.6
ORciscoios_xeMatch16.6.7
ORciscoios_xeMatch16.6.7a
ORciscoios_xeMatch16.6.8
ORciscoios_xeMatch16.7.1
ORciscoios_xeMatch16.7.1a
ORciscoios_xeMatch16.7.1b
ORciscoios_xeMatch16.7.2
ORciscoios_xeMatch16.7.3
ORciscoios_xeMatch16.7.4
ORciscoios_xeMatch16.8.1
ORciscoios_xeMatch16.8.1a
ORciscoios_xeMatch16.8.1b
ORciscoios_xeMatch16.8.1c
ORciscoios_xeMatch16.8.1d
ORciscoios_xeMatch16.8.1e
ORciscoios_xeMatch16.8.1s
ORciscoios_xeMatch16.8.2
ORciscoios_xeMatch16.8.3
ORciscoios_xeMatch16.9.1
ORciscoios_xeMatch16.9.1a
ORciscoios_xeMatch16.9.1b
ORciscoios_xeMatch16.9.1c
ORciscoios_xeMatch16.9.1d
ORciscoios_xeMatch16.9.1s
ORciscoios_xeMatch16.9.2
ORciscoios_xeMatch16.9.2a
ORciscoios_xeMatch16.9.2s
ORciscoios_xeMatch16.9.3
ORciscoios_xeMatch16.9.3a
ORciscoios_xeMatch16.9.3h
ORciscoios_xeMatch16.9.3s
ORciscoios_xeMatch16.9.4
ORciscoios_xeMatch16.9.4c
ORciscoios_xeMatch16.9.5
ORciscoios_xeMatch16.9.5f
ORciscoios_xeMatch16.9.6
ORciscoios_xeMatch16.10.1
ORciscoios_xeMatch16.10.1a
ORciscoios_xeMatch16.10.1b
ORciscoios_xeMatch16.10.1c
ORciscoios_xeMatch16.10.1d
ORciscoios_xeMatch16.10.1e
ORciscoios_xeMatch16.10.1f
ORciscoios_xeMatch16.10.1g
ORciscoios_xeMatch16.10.1s
ORciscoios_xeMatch16.10.2
ORciscoios_xeMatch16.10.3
ORciscoios_xeMatch16.11.1
ORciscoios_xeMatch16.11.1a
ORciscoios_xeMatch16.11.1b
ORciscoios_xeMatch16.11.1c
ORciscoios_xeMatch16.11.1s
ORciscoios_xeMatch16.11.2
ORciscoios_xeMatch16.12.1
ORciscoios_xeMatch16.12.1a
ORciscoios_xeMatch16.12.1c
ORciscoios_xeMatch16.12.1s
ORciscoios_xeMatch16.12.1t
ORciscoios_xeMatch16.12.1w
ORciscoios_xeMatch16.12.1x
ORciscoios_xeMatch16.12.1y
ORciscoios_xeMatch16.12.1z
ORciscoios_xeMatch16.12.2
ORciscoios_xeMatch16.12.2a
ORciscoios_xeMatch16.12.2s
ORciscoios_xeMatch16.12.2t
ORciscoios_xeMatch16.12.3
ORciscoios_xeMatch16.12.3a
ORciscoios_xeMatch16.12.3s
ORciscoios_xeMatch16.12.4
ORciscoios_xeMatch16.12.4a
ORciscoios_xeMatch17.1.1
ORciscoios_xeMatch17.1.1a
ORciscoios_xeMatch17.1.1s
ORciscoios_xeMatch17.1.1t
ORciscoios_xeMatch17.1.2
ORciscoios_xeMatch17.2.1
ORciscoios_xeMatch17.2.1a
ORciscoios_xeMatch17.2.1r
ORciscoios_xeMatch17.2.1v
| Vendor | Product | Version | CPE |
|---|---|---|---|
| cisco | ios_xe | 3.6.3e | cpe:2.3:o:cisco:ios_xe:3.6.3e:*:*:*:*:*:*:* |
| cisco | ios_xe | 3.6.4e | cpe:2.3:o:cisco:ios_xe:3.6.4e:*:*:*:*:*:*:* |
| cisco | ios_xe | 3.6.5ae | cpe:2.3:o:cisco:ios_xe:3.6.5ae:*:*:*:*:*:*:* |
| cisco | ios_xe | 3.6.5be | cpe:2.3:o:cisco:ios_xe:3.6.5be:*:*:*:*:*:*:* |
| cisco | ios_xe | 3.6.5e | cpe:2.3:o:cisco:ios_xe:3.6.5e:*:*:*:*:*:*:* |
| cisco | ios_xe | 3.6.6e | cpe:2.3:o:cisco:ios_xe:3.6.6e:*:*:*:*:*:*:* |
| cisco | ios_xe | 3.6.7ae | cpe:2.3:o:cisco:ios_xe:3.6.7ae:*:*:*:*:*:*:* |
| cisco | ios_xe | 3.6.7be | cpe:2.3:o:cisco:ios_xe:3.6.7be:*:*:*:*:*:*:* |
| cisco | ios_xe | 3.6.7e | cpe:2.3:o:cisco:ios_xe:3.6.7e:*:*:*:*:*:*:* |
| cisco | ios_xe | 3.6.8e | cpe:2.3:o:cisco:ios_xe:3.6.8e:*:*:*:*:*:*:* |
CNA Affected
[
{
"product": "Cisco IOS XE Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]Related
cisco
cisco
Cisco IOS XE Software Plug-and-Play Privilege Escalation Vulnerability
2021-03-24 16:00:00
prion
prion
Security feature bypass
2021-03-24 20:15:00
nvd
nvd
CVE-2021-1442
2021-03-24 20:15:15
cvelist
cvelist
nessus
nessus
ics
ics
Rockwell Automation Stratix Switches
2021-04-20 12:00:00
CVSS2
6.9
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
7.7
Confidence
High
EPSS
0
Percentile
5.1%
Related for CVE-2021-1442