Sign-up

ID

VAR-202103-0532


CVE

CVE-2021-1432


TITLE

Cisco IOS XE SD-WAN  Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-004767

DESCRIPTION

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the root user. The attacker must be authenticated on the affected device as a low-privileged user to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by injecting arbitrary commands to a file as a lower-privileged user. The commands are then executed on the device by the root user. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco IOS XE SD-WAN Is vulnerable to injection.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Cisco IOS XE SD-WAN Software is a software for network management (software-defined networking) applied to the Cisco IOS XE network operating system from Cisco

Trust: 1.8

sources: NVD: CVE-2021-1432 // JVNDB: JVNDB-2021-004767 // VULHUB: VHN-374486 // VULMON: CVE-2021-1432

AFFECTED PRODUCTS

vendor:ciscomodel:ios xescope:eqversion:16.12.1z

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:17.2.1a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.2t

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.1y

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.3a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.1t

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.1za

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.1s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.2a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.15.2xbs

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.1a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.1w

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:17.2.1v

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.4a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.1x

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.15.1xbs

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.4

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:17.2.1r

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:17.2.1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.3

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.3s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.1c

Trust: 1.0

vendor:ciscomodel:ios xe sd-wanscope:eqversion:*

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.2s

Trust: 1.0

vendor:シスコシステムズmodel:cisco ios xescope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco ios xescope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-004767 // NVD: CVE-2021-1432

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-1432
value: HIGH

Trust: 1.0

ykramarz@cisco.com: CVE-2021-1432
value: HIGH

Trust: 1.0

NVD: CVE-2021-1432
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202103-1426
value: HIGH

Trust: 0.6

VULHUB: VHN-374486
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-1432
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-1432
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-374486
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-1432
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.3
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2021-1432
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-374486 // VULMON: CVE-2021-1432 // JVNDB: JVNDB-2021-004767 // CNNVD: CNNVD-202103-1426 // NVD: CVE-2021-1432 // NVD: CVE-2021-1432

PROBLEMTYPE DATA

problemtype:CWE-74

Trust: 1.1

problemtype:CWE-20

Trust: 1.0

problemtype:injection (CWE-74) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-374486 // JVNDB: JVNDB-2021-004767 // NVD: CVE-2021-1432

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202103-1426

TYPE

injection

Trust: 0.6

sources: CNNVD: CNNVD-202103-1426

PATCH

title:cisco-sa-iosxe-sdwarbcmdexec-sspOMUr3url:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-sdwarbcmdexec-sspOMUr3

Trust: 0.8

title:Cisco IOS XE SD-WAN Software Repair measures for injecting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=145722

Trust: 0.6

title:Cisco: Cisco IOS XE SD-WAN Software Arbitrary Command Execution Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-iosxe-sdwarbcmdexec-sspOMUr3

Trust: 0.1

sources: VULMON: CVE-2021-1432 // JVNDB: JVNDB-2021-004767 // CNNVD: CNNVD-202103-1426

EXTERNAL IDS

db:NVDid:CVE-2021-1432

Trust: 2.6

db:JVNDBid:JVNDB-2021-004767

Trust: 0.8

db:CNNVDid:CNNVD-202103-1426

Trust: 0.7

db:VULHUBid:VHN-374486

Trust: 0.1

db:VULMONid:CVE-2021-1432

Trust: 0.1

sources: VULHUB: VHN-374486 // VULMON: CVE-2021-1432 // JVNDB: JVNDB-2021-004767 // CNNVD: CNNVD-202103-1426 // NVD: CVE-2021-1432

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-iosxe-sdwarbcmdexec-sspomur3

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-1432

Trust: 1.4

url:https://vigilance.fr/vulnerability/cisco-ios-ios-xe-multiple-vulnerabilities-34940

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/74.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/198739

Trust: 0.1

sources: VULHUB: VHN-374486 // VULMON: CVE-2021-1432 // JVNDB: JVNDB-2021-004767 // CNNVD: CNNVD-202103-1426 // NVD: CVE-2021-1432

SOURCES

db:VULHUBid:VHN-374486
db:VULMONid:CVE-2021-1432
db:JVNDBid:JVNDB-2021-004767
db:CNNVDid:CNNVD-202103-1426
db:NVDid:CVE-2021-1432

LAST UPDATE DATE

2024-08-14T15:22:22.038000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-374486date:2021-03-29T00:00:00
db:VULMONid:CVE-2021-1432date:2021-03-29T00:00:00
db:JVNDBid:JVNDB-2021-004767date:2021-11-29T09:16:00
db:CNNVDid:CNNVD-202103-1426date:2021-03-30T00:00:00
db:NVDid:CVE-2021-1432date:2023-11-07T03:28:17.963

SOURCES RELEASE DATE

db:VULHUBid:VHN-374486date:2021-03-24T00:00:00
db:VULMONid:CVE-2021-1432date:2021-03-24T00:00:00
db:JVNDBid:JVNDB-2021-004767date:2021-11-29T00:00:00
db:CNNVDid:CNNVD-202103-1426date:2021-03-24T00:00:00
db:NVDid:CVE-2021-1432date:2021-03-24T20:15:14.510