Sign-up

ID

VAR-202105-0512


CVE

CVE-2021-1558


TITLE

Cisco DNA Spaces Connector  In  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-007185

DESCRIPTION

Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. These vulnerabilities are due to insufficient restrictions during the execution of affected CLI commands. An attacker could exploit these vulnerabilities by leveraging the insufficient restrictions during execution of these commands. A successful exploit could allow the attacker to elevate privileges from dnasadmin and execute arbitrary commands on the underlying operating system as root. Cisco DNA Spaces Connector Has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Cisco DNA Spaces is an indoor positioning service platform of Cisco (Cisco)

Trust: 2.34

sources: NVD: CVE-2021-1558 // JVNDB: JVNDB-2021-007185 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-374612 // VULMON: CVE-2021-1558

AFFECTED PRODUCTS

vendor:ciscomodel:dna spaces\: connectorscope:ltversion:2.3.1

Trust: 1.0

vendor:シスコシステムズmodel:cisco dna spaces: connectorscope:eqversion: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco dna spaces: connectorscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-007185 // NVD: CVE-2021-1558

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-1558
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2021-1558
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-1558
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202105-1295
value: MEDIUM

Trust: 0.6

VULHUB: VHN-374612
value: HIGH

Trust: 0.1

VULMON: CVE-2021-1558
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-1558
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-374612
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-1558
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2021-1558
baseSeverity: MEDIUM
baseScore: 6.0
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 0.8
impactScore: 5.2
version: 3.1

Trust: 1.0

NVD: CVE-2021-1558
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-374612 // VULMON: CVE-2021-1558 // JVNDB: JVNDB-2021-007185 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-1295 // NVD: CVE-2021-1558 // NVD: CVE-2021-1558

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.1

problemtype:OS Command injection (CWE-78) [ Other ]

Trust: 0.8

sources: VULHUB: VHN-374612 // JVNDB: JVNDB-2021-007185 // NVD: CVE-2021-1558

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202105-1295

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:cisco-sa-dnasp-conn-prvesc-q6T6BzWurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnasp-conn-prvesc-q6T6BzW

Trust: 0.8

title:Cisco DNA Spaces Connector Fixes for operating system command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=151616

Trust: 0.6

title:Cisco: Cisco DNA Spaces Connector Privilege Escalation Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-dnasp-conn-prvesc-q6T6BzW

Trust: 0.1

sources: VULMON: CVE-2021-1558 // JVNDB: JVNDB-2021-007185 // CNNVD: CNNVD-202105-1295

EXTERNAL IDS

db:NVDid:CVE-2021-1558

Trust: 3.4

db:JVNDBid:JVNDB-2021-007185

Trust: 0.8

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:CS-HELPid:SB2021052007

Trust: 0.6

db:AUSCERTid:ESB-2021.1745

Trust: 0.6

db:CNNVDid:CNNVD-202105-1295

Trust: 0.6

db:VULHUBid:VHN-374612

Trust: 0.1

db:VULMONid:CVE-2021-1558

Trust: 0.1

sources: VULHUB: VHN-374612 // VULMON: CVE-2021-1558 // JVNDB: JVNDB-2021-007185 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-1295 // NVD: CVE-2021-1558

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-dnasp-conn-prvesc-q6t6bzw

Trust: 1.9

url:https://nvd.nist.gov/vuln/detail/cve-2021-1558

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021052007

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1745

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/78.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-374612 // VULMON: CVE-2021-1558 // JVNDB: JVNDB-2021-007185 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-1295 // NVD: CVE-2021-1558

SOURCES

db:VULHUBid:VHN-374612
db:VULMONid:CVE-2021-1558
db:JVNDBid:JVNDB-2021-007185
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202105-1295
db:NVDid:CVE-2021-1558

LAST UPDATE DATE

2024-08-14T12:48:02.475000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-374612date:2021-05-27T00:00:00
db:VULMONid:CVE-2021-1558date:2021-05-27T00:00:00
db:JVNDBid:JVNDB-2021-007185date:2022-02-03T08:31:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202105-1295date:2021-05-28T00:00:00
db:NVDid:CVE-2021-1558date:2023-11-07T03:28:37.453

SOURCES RELEASE DATE

db:VULHUBid:VHN-374612date:2021-05-22T00:00:00
db:VULMONid:CVE-2021-1558date:2021-05-22T00:00:00
db:JVNDBid:JVNDB-2021-007185date:2022-02-03T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202105-1295date:2021-05-20T00:00:00
db:NVDid:CVE-2021-1558date:2021-05-22T07:15:07.880