Lucene search

CiscoCVE-2021-1571

HistoryJun 16, 2021 - 6:15 p.m.

CVE-2021-1571

2021-06-1618:15:09

CWE-287

CWE-79

cisco

web.nvd.nist.gov

cisco

small business

220 series

smart switches

vulnerabilities

cve-2021-1571

web-based management interface

user session hijacking

arbitrary command execution

root user

cross-site scripting

xss

html injection

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

30.3%

JSON

Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.

Affected configurations

Nvd

Node

ciscosf220-24_firmwareRange<1.2.0.6

AND

ciscosf220-24Match-

Node

ciscosf220-24p_firmwareRange<1.2.0.6

AND

ciscosf220-24pMatch-

Node

ciscosf220-48_firmwareRange<1.2.0.6

AND

ciscosf220-48Match-

Node

ciscosf220-48p_firmwareRange<1.2.0.6

AND

ciscosf220-48pMatch-

Node

ciscosg220-26_firmwareRange<1.2.0.6

AND

ciscosg220-26Match-

Node

ciscosg220-26p_firmwareRange<1.2.0.6

AND

ciscosg220-26pMatch-

Node

ciscosg220-28mp_firmwareRange<1.2.0.6

AND

ciscosg220-28mpMatch-

Node

ciscosg220-50_firmwareRange<1.2.0.6

AND

ciscosg220-50Match-

Node

ciscosg220-50p_firmwareRange<1.2.0.6

AND

ciscosg220-50pMatch-

VendorProductVersionCPE
ciscosf220-24_firmware*cpe:2.3:o:cisco:sf220-24_firmware:*:*:*:*:*:*:*:*
ciscosf220-24-cpe:2.3:h:cisco:sf220-24:-:*:*:*:*:*:*:*
ciscosf220-24p_firmware*cpe:2.3:o:cisco:sf220-24p_firmware:*:*:*:*:*:*:*:*
ciscosf220-24p-cpe:2.3:h:cisco:sf220-24p:-:*:*:*:*:*:*:*
ciscosf220-48_firmware*cpe:2.3:o:cisco:sf220-48_firmware:*:*:*:*:*:*:*:*
ciscosf220-48-cpe:2.3:h:cisco:sf220-48:-:*:*:*:*:*:*:*
ciscosf220-48p_firmware*cpe:2.3:o:cisco:sf220-48p_firmware:*:*:*:*:*:*:*:*
ciscosf220-48p-cpe:2.3:h:cisco:sf220-48p:-:*:*:*:*:*:*:*
ciscosg220-26_firmware*cpe:2.3:o:cisco:sg220-26_firmware:*:*:*:*:*:*:*:*
ciscosg220-26-cpe:2.3:h:cisco:sg220-26:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	sf220-24_firmware	*	cpe:2.3:o:cisco:sf220-24_firmware::::::::
cisco	sf220-24	-	cpe:2.3:h:cisco:sf220-24:-:::::::*
cisco	sf220-24p_firmware	*	cpe:2.3:o:cisco:sf220-24p_firmware::::::::
cisco	sf220-24p	-	cpe:2.3:h:cisco:sf220-24p:-:::::::*
cisco	sf220-48_firmware	*	cpe:2.3:o:cisco:sf220-48_firmware::::::::
cisco	sf220-48	-	cpe:2.3:h:cisco:sf220-48:-:::::::*
cisco	sf220-48p_firmware	*	cpe:2.3:o:cisco:sf220-48p_firmware::::::::
cisco	sf220-48p	-	cpe:2.3:h:cisco:sf220-48p:-:::::::*
cisco	sg220-26_firmware	*	cpe:2.3:o:cisco:sg220-26_firmware::::::::
cisco	sg220-26	-	cpe:2.3:h:cisco:sg220-26:-:::::::*

Rows per page:

1-10 of 181

CNA Affected

[
  {
    "product": "Cisco Small Business 220 Series Smart Plus Switches",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

30.3%

JSON

Related for CVE-2021-1571