Sign-up

ID

VAR-202109-1848


CVE

CVE-2021-34729


TITLE

Cisco IOS XE SD-WAN Software Operating system command injection vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202109-1560

DESCRIPTION

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software and Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges on an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input in the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands with elevated privileges on the underlying operating system. An attacker would need valid user credentials to exploit this vulnerability. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 1.62

sources: NVD: CVE-2021-34729 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-394971 // VULMON: CVE-2021-34729

AFFECTED PRODUCTS

vendor:ciscomodel:ios xe sd-wanscope:lteversion:17.3.1a

Trust: 1.0

vendor:ciscomodel:ios xescope:lteversion:17.3.1a

Trust: 1.0

sources: NVD: CVE-2021-34729

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-34729
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2021-34729
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-202109-1560
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

VULHUB: VHN-394971
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-34729
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-394971
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-34729
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.1

Trust: 2.0

sources: VULHUB: VHN-394971 // CNNVD: CNNVD-202109-1560 // CNNVD: CNNVD-202104-975 // NVD: CVE-2021-34729 // NVD: CVE-2021-34729

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.1

problemtype:CWE-78

Trust: 1.1

sources: VULHUB: VHN-394971 // NVD: CVE-2021-34729

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202109-1560

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202109-1560

PATCH

title:Cisco IOS XE SD-WAN Software Fixes for command injection vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=163441

Trust: 0.6

sources: CNNVD: CNNVD-202109-1560

EXTERNAL IDS

db:NVDid:CVE-2021-34729

Trust: 1.8

db:AUSCERTid:ESB-2021.3179

Trust: 0.6

db:CS-HELPid:SB2021092415

Trust: 0.6

db:CNNVDid:CNNVD-202109-1560

Trust: 0.6

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:VULHUBid:VHN-394971

Trust: 0.1

db:VULMONid:CVE-2021-34729

Trust: 0.1

sources: VULHUB: VHN-394971 // VULMON: CVE-2021-34729 // CNNVD: CNNVD-202109-1560 // CNNVD: CNNVD-202104-975 // NVD: CVE-2021-34729

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ioxesdwan-clicmdinj-7byx5k3

Trust: 2.4

url:https://vigilance.fr/vulnerability/cisco-ios-xe-sd-wan-software-privilege-escalation-via-command-injection-36504

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021092415

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3179

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-34729

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-394971 // VULMON: CVE-2021-34729 // CNNVD: CNNVD-202109-1560 // CNNVD: CNNVD-202104-975 // NVD: CVE-2021-34729

SOURCES

db:VULHUBid:VHN-394971
db:VULMONid:CVE-2021-34729
db:CNNVDid:CNNVD-202109-1560
db:CNNVDid:CNNVD-202104-975
db:NVDid:CVE-2021-34729

LAST UPDATE DATE

2024-08-14T12:53:29.535000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-394971date:2022-10-24T00:00:00
db:VULMONid:CVE-2021-34729date:2021-09-23T00:00:00
db:CNNVDid:CNNVD-202109-1560date:2022-10-25T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:NVDid:CVE-2021-34729date:2023-11-07T03:36:13.717

SOURCES RELEASE DATE

db:VULHUBid:VHN-394971date:2021-09-23T00:00:00
db:VULMONid:CVE-2021-34729date:2021-09-23T00:00:00
db:CNNVDid:CNNVD-202109-1560date:2021-09-22T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:NVDid:CVE-2021-34729date:2021-09-23T03:15:19.837