CVE-2021-1383 vulnerability in Cisco Products
Published on March 24, 2021
Cisco IOS XE SD-WAN Software Parameter Injection Vulnerabilities
Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with root privileges. These vulnerabilities are due to insufficient input validation of certain CLI commands. An attacker could exploit these vulnerabilities by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated as an administrative user to execute the affected commands. A successful exploit could allow the attacker to access the underlying operating system with root privileges.
Vulnerability Analysis
CVE-2021-1383 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2021-1383. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Products Associated with CVE-2021-1383
stack.watch emails you whenever new vulnerabilities are published in Cisco IOS XE or Cisco Ios Xe Sd Wan. Just hit a watch button to start following.
Affected Versions
Cisco IOS XE Software Version n/a is affected by CVE-2021-1383Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.