Details of VAR-202103-0775

ID

VAR-202103-0775

CVE

CVE-2021-1437

TITLE

Cisco Aironet Series Access Points Software permission vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2021-004967

DESCRIPTION

A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device. This vulnerability is due to an unrestricted Trivial File Transfer Protocol (TFTP) configuration. An attacker could exploit this vulnerability by sending a specific TFTP request to an affected device. A successful exploit could allow the attacker to download any file from the filesystem of the affected access point (AP)

Trust: 1.8

sources: NVD: CVE-2021-1437 // JVNDB: JVNDB-2021-004967 // VULHUB: VHN-374491 // VULMON: CVE-2021-1437

AFFECTED PRODUCTS

vendor:	cisco	model:	catalyst 9800	scope:	gte	version:	17.1	Trust: 1.0
vendor:	cisco	model:	aironet access point software	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	wireless lan controller software	scope:	lt	version:	8.10.142.0	Trust: 1.0
vendor:	cisco	model:	wireless lan controller software	scope:	gte	version:	8.10.112.0	Trust: 1.0
vendor:	cisco	model:	catalyst 9800	scope:	lt	version:	17.3.3	Trust: 1.0
vendor:	シスコシステムズ	model:	cisco catalyst 9800 シリーズ	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco wireless lan controller ソフトウェア	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco aironet アクセスポイントソフトウェア	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-004967 // NVD: CVE-2021-1437

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-1437
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-1437
value:	HIGH
Trust: 1.0
NVD:	CVE-2021-1437
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202103-1387
value:	HIGH
Trust: 0.6
VULHUB:	VHN-374491
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2021-1437
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-1437
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-374491
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-1437
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 2.0
NVD:	CVE-2021-1437
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-374491 // VULMON: CVE-2021-1437 // JVNDB: JVNDB-2021-004967 // CNNVD: CNNVD-202103-1387 // NVD: CVE-2021-1437 // NVD: CVE-2021-1437

PROBLEMTYPE DATA

problemtype:	CWE-275	Trust: 1.0
problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	Permission issues (CWE-275) [ Other ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-004967 // NVD: CVE-2021-1437

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202103-1387

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202103-1387

PATCH

title:	cisco-sa-aironet-info-disc-BfWqghj	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironet-info-disc-BfWqghj	Trust: 0.8
title:	Cisco Aironet Series Access Points Software Remediation measures for authorization problem vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=145693	Trust: 0.6
title:	Cisco: Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure Vulnerability	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-aironet-info-disc-BfWqghj	Trust: 0.1

sources: VULMON: CVE-2021-1437 // JVNDB: JVNDB-2021-004967 // CNNVD: CNNVD-202103-1387

EXTERNAL IDS

db:	NVD	id:	CVE-2021-1437	Trust: 2.6
db:	JVNDB	id:	JVNDB-2021-004967	Trust: 0.8
db:	CNNVD	id:	CNNVD-202103-1387	Trust: 0.6
db:	VULHUB	id:	VHN-374491	Trust: 0.1
db:	VULMON	id:	CVE-2021-1437	Trust: 0.1

sources: VULHUB: VHN-374491 // VULMON: CVE-2021-1437 // JVNDB: JVNDB-2021-004967 // CNNVD: CNNVD-202103-1387 // NVD: CVE-2021-1437

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-aironet-info-disc-bfwqghj	Trust: 1.9
url:	https://nvd.nist.gov/vuln/detail/cve-2021-1437	Trust: 1.4
url:	https://vigilance.fr/vulnerability/cisco-aironet-multiple-vulnerabilities-34939	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/275.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-374491 // VULMON: CVE-2021-1437 // JVNDB: JVNDB-2021-004967 // CNNVD: CNNVD-202103-1387 // NVD: CVE-2021-1437

SOURCES

db:	VULHUB	id:	VHN-374491
db:	VULMON	id:	CVE-2021-1437
db:	JVNDB	id:	JVNDB-2021-004967
db:	CNNVD	id:	CNNVD-202103-1387
db:	NVD	id:	CVE-2021-1437

LAST UPDATE DATE

2024-08-14T15:33:14.645000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-374491	date:	2022-10-21T00:00:00
db:	VULMON	id:	CVE-2021-1437	date:	2021-03-31T00:00:00
db:	JVNDB	id:	JVNDB-2021-004967	date:	2021-12-02T09:13:00
db:	CNNVD	id:	CNNVD-202103-1387	date:	2022-10-24T00:00:00
db:	NVD	id:	CVE-2021-1437	date:	2023-11-07T03:28:18.740

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-374491	date:	2021-03-24T00:00:00
db:	VULMON	id:	CVE-2021-1437	date:	2021-03-24T00:00:00
db:	JVNDB	id:	JVNDB-2021-004967	date:	2021-12-02T00:00:00
db:	CNNVD	id:	CNNVD-202103-1387	date:	2021-03-24T00:00:00
db:	NVD	id:	CVE-2021-1437	date:	2021-03-24T20:15:14.900