All the vulnerabilites related to cisco - sd-wan_vbond_orchestrator
Vulnerability from fkie_nvd
Published
2022-09-30 19:15
Modified
2024-11-21 06:43
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A52514-31EF-4AEF-967B-FAD0FD67E54D",
"versionEndExcluding": "20.6.3",
"versionStartIncluding": "20.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "475E91CB-34F3-4B63-8CCE-7F0A9A02D136",
"versionEndExcluding": "20.7.2",
"versionStartIncluding": "20.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.8:*:*:*:*:*:*:*",
"matchCriteriaId": "0493FE21-BB5A-41D3-9EBD-2C2BD165D5CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4300237B-0872-49AD-B139-DBED88329796",
"versionEndExcluding": "20.6.3",
"versionStartIncluding": "20.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C7585F8E-F42D-4EA2-8CBC-E157252868B9",
"versionEndExcluding": "20.7.2",
"versionStartIncluding": "20.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:20.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B62FF06E-8A11-41B5-B67C-9C008B5832F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "60E3B315-1E13-4C27-8506-2D3C45D7A7CC",
"versionEndExcluding": "20.6.3",
"versionStartIncluding": "20.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "85F91EBF-3E14-453A-AEF9-BA2BB9F4445C",
"versionEndExcluding": "20.7.2",
"versionStartIncluding": "20.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.8:*:*:*:*:*:*:*",
"matchCriteriaId": "D65F88EF-F2A8-4798-A88B-5B0584760E7A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0F0A437E-56C5-4DD2-90C4-5E62D2C97A9A",
"versionEndExcluding": "20.6.3",
"versionStartIncluding": "20.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9113890B-7A2A-4FD1-8328-169E4AB41117",
"versionEndExcluding": "20.7.2",
"versionStartIncluding": "20.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan:20.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8CEAD0DC-6407-4D23-A73D-0089C31CEB39",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_8000v_edge:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF365FC4-46E3-4564-9F25-1C2FBE70057B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_cg418-e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "36AFCB37-1760-4808-AEA5-875F45C05464",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_cg522-e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C146F67C-0FCF-4C5C-B6B8-D67746E69CFB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F77CD6A-83DA-4F31-A128-AD6DAECD623B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2D2305B-B69E-4F74-A44E-07B3205CE9F7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B68B363-3C57-4E95-8B13-0F9B59D551F7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "26DD41B3-1D1D-44D3-BA8E-5A66AFEE77E6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1952B64C-4AE0-4CCB-86C5-8D1FF6A12822",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5AAD4397-6DCF-493A-BD61-3A890F6F3AB2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5EB8A757-7888-4AC2-BE44-B89DB83C6C77",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3F2F0A8E-97F6-41AC-BE67-4B2D60F9D36B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BB9229F3-7BCE-46C4-9879-D57B5BAAE44E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B80890A8-E3D3-462C-B125-9E9BC6525B02",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A5A606FE-E6F1-43F9-B1CD-D9DF35FC3573",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1111x_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0547E196-5991-4C33-823A-342542E9DFD3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:111x_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "802CBFC1-8A2F-4BF7-A1D3-00622C33BE16",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7AFE0FC1-EEBC-42F0-88B0-4AF5B76DDD97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F3F374DC-B9F7-4515-A064-01BB436CA984",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D916389F-54DB-44CB-91DD-7CE3C7059350",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4000_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CE82335E-ECEC-47BD-BC4A-5FDEA08D1A18",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6C8AED7C-DDA3-4C29-BB95-6518C02C551A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4321\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05C90C43-2D7D-43F8-AD7F-421878909AE2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4321\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "445597DA-7EEC-470D-9A71-BC43A9F7DE5E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4321\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "86049773-C88D-4A26-A0D3-D40F3C312AEC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9421DBEF-AE42-4234-B49F-FCC34B804D7F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4331\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6AB4B7C2-4D45-4267-BCBB-57D36C6104A3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4331\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B8A4630-8B21-4994-8EF5-E105593A64E5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4331\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F799DC02-EB06-458C-8545-A174475FE7A2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5419CB9F-241F-4431-914F-2659BE27BEA5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4351\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B89FBA68-A8ED-4C5A-916E-A68468F59730",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4351\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD272E6E-2ED1-4408-8FF7-0B82F9DCBEF8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4351\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DC278B77-AD63-42AD-B9E8-EE4DE97E27E9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4351_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7DE02DBE-EAD5-4F37-8AB7-DF46A605A0E2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5720462A-BE6B-4E84-A1A1-01E80BBA86AD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "818CEFA6-208C-43C3-8E43-474A93ADCF21",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4451_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "82225D40-537F-41D2-B1C4-1B7D06466B06",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8B60888-6E2B-494E-AC65-83337661EE7D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8101-32fh:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E055F58F-F9FB-4B27-841E-61ECAB5F42B8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8101-32h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B832863-E366-46ED-BC35-838762F0CE29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8102-64h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A3C3DDAC-7D0F-4D1D-9632-F001F2EB5D34",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3D8E7FFF-82A8-4ECB-BA0C-CBF0C2FDA3A3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8201-32fh:-:*:*:*:*:*:*:*",
"matchCriteriaId": "528BE0D3-E5ED-4836-B0D8-0C8508C5BDD7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87DC4C2F-01C5-4D89-8D79-E5D28EDAD0F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8804:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6655851F-58D9-49D9-A56E-8440A7F7BB45",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8808:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5E2AE67-DED3-4414-A194-386ADB2C8DC7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8812:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3920133A-684D-4A9F-B65A-FF4EAE5052E5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8818:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9ED06361-5A68-4656-AEA5-240C290594CD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BE2514A1-486C-40F7-8746-56E2B973CBE6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "91209C16-A620-44A0-9134-8AA456343F29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE2182E7-C813-4966-A36C-E648A9344299",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*",
"matchCriteriaId": "ED7C321E-F083-4AB6-96A0-D6358980441E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7594E307-AC80-41EC-AE94-07E664A7D701",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1001-hx_r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33208B25-0CBB-4E31-A892-60B7B5625155",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "09C913FF-63D5-43FB-8B39-598EF436BA5A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1001-x_r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "241EEBD9-76E4-4AE6-96B8-1C1ACD834F17",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E4376E56-A21C-4642-A85D-439C8E21CD7F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD2794BD-C8CE-46EF-9857-1723FCF04E46",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1002-hx_r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CC03A84F-C8F2-4225-9A00-8FA35368CD57",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "444F688F-79D0-4F22-B530-7BD520080B8F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1002-x_r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "51F2A755-556C-4C5E-8622-96D124319AF7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "55DD2272-10C2-43B9-9F13-6DC41DBE179B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7428E0A8-1641-47FB-9CA9-34311DEF660D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DE7401B7-094C-46EB-9869-2F0372E8B26B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8D8A72FD-D8B0-45B5-8FAD-6D8395BB218A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*",
"matchCriteriaId": "854D9594-FE84-4E7B-BA21-A3287F2DC302",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C81CC6E3-B989-4730-820E-46734E3E608D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EE9EABE0-5FB0-4277-A389-87732E750B7C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8300:-:*:*:*:*:*:*:*",
"matchCriteriaId": "72BBF8E8-7AD9-46B8-8B02-F0DB1F95E1CD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8300-1n1s-4t2x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5E7E8914-7B25-4097-8B22-6928C1F03D5A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8300-1n1s-6t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B207857B-C483-47DF-9FC7-6A05B866BF60",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8300-2n2s-4t2x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD26746A-80D1-4C48-BF77-E9F7EEEF7EA7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8300-2n2s-6t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BDB16CCE-1E89-4707-86C1-97F2FB5B62B9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7A82CE19-C3C4-4FAD-A1B3-AB91EDB61591",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8500-4qc:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A1DBA393-232D-40E6-9CDB-DF82D2E7A5B6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8500l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "04AB61E9-0148-495E-BD21-64D52DE60A6C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8510csr:-:*:*:*:*:*:*:*",
"matchCriteriaId": "85D2C587-E95B-4E74-88CF-5930072258D3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8510msr:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D3D1BB0B-0EFE-4C6D-A18E-3E48ABA01F00",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8540csr:-:*:*:*:*:*:*:*",
"matchCriteriaId": "74270062-2030-45A0-9C93-C1F3B7C88E8B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8540msr:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F403859-F034-4DD9-9CA5-708EADECB380",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user."
},
{
"lang": "es",
"value": "Varias vulnerabilidades en la CLI del software Cisco SD-WAN podr\u00edan permitir a un atacante local autenticado conseguir altos privilegios. Estas vulnerabilidades son debido a controles de acceso inapropiados en los comandos de la aplicaci\u00f3n CLI. Un atacante podr\u00eda explotar estas vulnerabilidades al ejecutar un comando malicioso en la CLI de la aplicaci\u00f3n. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante ejecutar comandos arbitrarios como usuario root"
}
],
"id": "CVE-2022-20775",
"lastModified": "2024-11-21T06:43:31.933",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-09-30T19:15:11.467",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc"
},
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"
},
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-25"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 20:15
Modified
2024-11-21 05:43
Severity ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | sd-wan_firmware | 18.2.0 | |
| cisco | sd-wan_firmware | 18.3.0 | |
| cisco | sd-wan_firmware | 18.3.8 | |
| cisco | sd-wan_firmware | 18.4.6 | |
| cisco | sd-wan_firmware | 19.2.3 | |
| cisco | sd-wan_firmware | 19.2.99 | |
| cisco | sd-wan_firmware | 20.1.0 | |
| cisco | sd-wan_vsmart_controller_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AF0E7F2D-6999-4FCD-A922-B57070FD9BCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B2C163B3-5B5D-4216-91FC-42757E3A680D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4CBD6FD9-84EE-416C-B77D-843D2FAAF1BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A04E45E9-9905-4FBC-B632-5EF429F6FC52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "478B7BB3-6358-46F6-8F59-786BA8D2AF5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.99:*:*:*:*:*:*:*",
"matchCriteriaId": "B74606C6-B292-4D23-8652-5CF49BDD8369",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:20.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF9C5E2-1A91-43A0-8F51-05A2E204BF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en los productos Cisco SD-WAN, podr\u00edan permitir a un atacante autenticado llevar a cabo ataques de inyecci\u00f3n de comandos contra un dispositivo afectado, lo que podr\u00eda permitirle al atacante tomar determinadas acciones con privilegios root en el dispositivo. Para m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
}
],
"id": "CVE-2021-1263",
"lastModified": "2024-11-21T05:43:57.417",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2,
"source": "ykramarz@cisco.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T20:15:15.127",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 20:15
Modified
2024-11-21 05:43
Severity ?
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | ios_xe_sd-wan | - | |
| cisco | sd-wan_firmware | 18.3.5 | |
| cisco | sd-wan_firmware | 18.3.8 | |
| cisco | sd-wan_firmware | 18.4.1 | |
| cisco | sd-wan_firmware | 18.4.4 | |
| cisco | sd-wan_firmware | 18.4.5 | |
| cisco | sd-wan_firmware | 19.2.0 | |
| cisco | sd-wan_firmware | 19.2.1 | |
| cisco | sd-wan_firmware | 19.2.2 | |
| cisco | sd-wan_firmware | 19.2.99 | |
| cisco | sd-wan_firmware | 20.1.0 | |
| cisco | sd-wan_vsmart_controller_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xe_sd-wan:-:*:*:*:*:*:*:*",
"matchCriteriaId": "16266B9E-E613-45FA-A02B-51EED8BEFCC9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "30EE0731-351C-4889-8335-3E7E7955A385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4CBD6FD9-84EE-416C-B77D-843D2FAAF1BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0015FD1E-1BCD-40AB-8C21-264AB9F6E123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F4C9F1DA-0527-4442-B0B4-4467960D30C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0717AEB4-93B0-47F5-9F1B-153A519AD2E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0065B109-5020-48AE-B10F-3452444748C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9C535AB3-DCCE-4CFB-8479-08550552E863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "07C2CBB8-7296-4549-B98C-D39FA1D35E6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.99:*:*:*:*:*:*:*",
"matchCriteriaId": "B74606C6-B292-4D23-8652-5CF49BDD8369",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:20.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF9C5E2-1A91-43A0-8F51-05A2E204BF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en los productos Cisco SD-WAN, podr\u00edan permitir a un atacante no autenticado remoto ejecutar ataques de denegaci\u00f3n de servicio (DoS) contra un dispositivo afectado. Para m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
}
],
"id": "CVE-2021-1273",
"lastModified": "2024-11-21T05:43:58.800",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T20:15:15.923",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "ykramarz@cisco.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-06 13:15
Modified
2024-11-21 05:44
Severity ?
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system of an affected system. This vulnerability is due to insufficient validation of the user-supplied input parameters of a specific CLI command. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content in any arbitrary files that reside on the underlying host file system.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB1FC04-6D73-42F5-9809-EF03C1394F75",
"versionEndExcluding": "19.2.3",
"versionStartIncluding": "19.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3366F4EC-9DCD-44F8-8430-1B3BA7A9B95F",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2D155FE-14C5-4658-A5D4-974DCE7FED4F",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE2C4782-DD4D-4113-A367-13DA609AD5F4",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*",
"matchCriteriaId": "37F7EB56-340D-46CE-BA4C-34FAE6843830",
"versionEndExcluding": "18.4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9E4006C4-164F-44EA-84BD-C0BBA5EBD59F",
"versionEndExcluding": "20.1.2",
"versionStartIncluding": "20.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vsmart_controller_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "300CB6ED-1ECC-4007-A522-06C07B83ED55",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vsmart_controller:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FF370668-127C-409B-83FE-293B830D4FB4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "86317BCD-C9A3-41A3-9BEB-EDAD5428B0DC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "00AAB4DD-1C45-412F-84AA-C056A0BBFB9A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_1000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "97D2D470-F97D-4B59-ACBA-866049389EF1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F019975D-3A45-4522-9CB9-F4258C371DF6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2036EAF7-2541-4C35-B1C4-9E0957272FAD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0811E0B5-889E-451E-B754-A8FEE32BDFA2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100m_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1693BEA9-3FCA-4B96-8CB2-E43BA56A9CCA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100m:-:*:*:*:*:*:*:*",
"matchCriteriaId": "36973815-F46D-4ADA-B9DF-BCB70AC60BD3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100wm_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "90003391-8A4D-4A7E-8D1B-AC1700D4CEDC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "061A302C-8D35-4E80-93DA-916DA7E90C06",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_2000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D5725A7-6EA8-405E-B1AF-7C787DD6728B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_2000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "140AF13E-4463-478B-AA94-97406A80CB86",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_5000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "050982D6-BB38-44D0-B67E-73DE9E7567AC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_5000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1356861D-E6CA-4973-9597-629507E8C07E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge-100b_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "61DE4E07-253D-44FD-93A4-3750603B44AC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge-100b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "07E7851F-3E72-4677-B907-CF777EBED2FF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_cloud_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "32A4CEAC-97A4-4A0A-BEF1-B015FBE4E6FF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud:-:*:*:*:*:*:*:*",
"matchCriteriaId": "94999112-9EAA-4707-B002-F867D7628C49",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system of an affected system. This vulnerability is due to insufficient validation of the user-supplied input parameters of a specific CLI command. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content in any arbitrary files that reside on the underlying host file system."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la CLI de Cisco SD-WAN Software, podr\u00eda permitir a un atacante local autenticado sobrescribir archivos arbitrarios en el sistema de archivos subyacente de un sistema afectado.\u0026#xa0;Esta vulnerabilidad es debido a una comprobaci\u00f3n insuficiente de los par\u00e1metros de la entrada proporcionados por el usuario de un comando CLI espec\u00edfico.\u0026#xa0;Un atacante podr\u00eda explotar esta vulnerabilidadal al emitir ese comando con par\u00e1metros espec\u00edficos.\u0026#xa0;Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante sobrescribir el contenido de cualquier archivo arbitrario que resida en el sistema de archivos del host subyacente"
}
],
"id": "CVE-2021-1512",
"lastModified": "2024-11-21T05:44:31.073",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 0.8,
"impactScore": 3.6,
"source": "ykramarz@cisco.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.8,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-06T13:15:10.817",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfile-7Qhd9mCn"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfile-7Qhd9mCn"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-552"
}
],
"source": "ykramarz@cisco.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 20:15
Modified
2024-11-21 05:43
Severity ?
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | ios_xe_sd-wan | - | |
| cisco | sd-wan_firmware | 18.3.5 | |
| cisco | sd-wan_firmware | 18.3.8 | |
| cisco | sd-wan_firmware | 18.4.1 | |
| cisco | sd-wan_firmware | 18.4.4 | |
| cisco | sd-wan_firmware | 18.4.5 | |
| cisco | sd-wan_firmware | 19.2.0 | |
| cisco | sd-wan_firmware | 19.2.1 | |
| cisco | sd-wan_firmware | 19.2.2 | |
| cisco | sd-wan_firmware | 19.2.99 | |
| cisco | sd-wan_firmware | 20.1.0 | |
| cisco | sd-wan_vsmart_controller_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xe_sd-wan:-:*:*:*:*:*:*:*",
"matchCriteriaId": "16266B9E-E613-45FA-A02B-51EED8BEFCC9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "30EE0731-351C-4889-8335-3E7E7955A385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4CBD6FD9-84EE-416C-B77D-843D2FAAF1BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0015FD1E-1BCD-40AB-8C21-264AB9F6E123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F4C9F1DA-0527-4442-B0B4-4467960D30C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0717AEB4-93B0-47F5-9F1B-153A519AD2E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0065B109-5020-48AE-B10F-3452444748C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9C535AB3-DCCE-4CFB-8479-08550552E863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "07C2CBB8-7296-4549-B98C-D39FA1D35E6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.99:*:*:*:*:*:*:*",
"matchCriteriaId": "B74606C6-B292-4D23-8652-5CF49BDD8369",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:20.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF9C5E2-1A91-43A0-8F51-05A2E204BF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en los productos Cisco SD-WAN, podr\u00edan permitir a un atacante no autenticado remoto ejecutar ataques de denegaci\u00f3n de servicio (DoS) contra un dispositivo afectado. Para m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
}
],
"id": "CVE-2021-1278",
"lastModified": "2024-11-21T05:43:59.477",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T20:15:16.173",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-59"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 20:15
Modified
2024-11-21 05:43
Severity ?
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | ios_xe_sd-wan | - | |
| cisco | sd-wan_firmware | 18.3.5 | |
| cisco | sd-wan_firmware | 18.3.8 | |
| cisco | sd-wan_firmware | 18.4.1 | |
| cisco | sd-wan_firmware | 18.4.4 | |
| cisco | sd-wan_firmware | 18.4.5 | |
| cisco | sd-wan_firmware | 19.2.0 | |
| cisco | sd-wan_firmware | 19.2.1 | |
| cisco | sd-wan_firmware | 19.2.2 | |
| cisco | sd-wan_firmware | 19.2.99 | |
| cisco | sd-wan_firmware | 20.1.0 | |
| cisco | sd-wan_vsmart_controller_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xe_sd-wan:-:*:*:*:*:*:*:*",
"matchCriteriaId": "16266B9E-E613-45FA-A02B-51EED8BEFCC9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "30EE0731-351C-4889-8335-3E7E7955A385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4CBD6FD9-84EE-416C-B77D-843D2FAAF1BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0015FD1E-1BCD-40AB-8C21-264AB9F6E123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F4C9F1DA-0527-4442-B0B4-4467960D30C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0717AEB4-93B0-47F5-9F1B-153A519AD2E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0065B109-5020-48AE-B10F-3452444748C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9C535AB3-DCCE-4CFB-8479-08550552E863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "07C2CBB8-7296-4549-B98C-D39FA1D35E6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.99:*:*:*:*:*:*:*",
"matchCriteriaId": "B74606C6-B292-4D23-8652-5CF49BDD8369",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:20.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF9C5E2-1A91-43A0-8F51-05A2E204BF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en los productos Cisco SD-WAN, podr\u00edan permitir a un atacante no autenticado remoto ejecutar ataques de denegaci\u00f3n de servicio (DoS) contra un dispositivo afectado. Para m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
}
],
"id": "CVE-2021-1279",
"lastModified": "2024-11-21T05:43:59.593",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T20:15:16.253",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-06 13:15
Modified
2024-11-21 05:44
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A vulnerability in the vDaemon process of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient handling of malformed packets. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8782BEB0-5880-4DF8-A0E3-A8F45437E121",
"versionEndExcluding": "20.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2D155FE-14C5-4658-A5D4-974DCE7FED4F",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE2C4782-DD4D-4113-A367-13DA609AD5F4",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vsmart_controller_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "300CB6ED-1ECC-4007-A522-06C07B83ED55",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vsmart_controller:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FF370668-127C-409B-83FE-293B830D4FB4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "86317BCD-C9A3-41A3-9BEB-EDAD5428B0DC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "00AAB4DD-1C45-412F-84AA-C056A0BBFB9A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_1000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "97D2D470-F97D-4B59-ACBA-866049389EF1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F019975D-3A45-4522-9CB9-F4258C371DF6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2036EAF7-2541-4C35-B1C4-9E0957272FAD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0811E0B5-889E-451E-B754-A8FEE32BDFA2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100m_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1693BEA9-3FCA-4B96-8CB2-E43BA56A9CCA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100m:-:*:*:*:*:*:*:*",
"matchCriteriaId": "36973815-F46D-4ADA-B9DF-BCB70AC60BD3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100wm_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "90003391-8A4D-4A7E-8D1B-AC1700D4CEDC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "061A302C-8D35-4E80-93DA-916DA7E90C06",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_2000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D5725A7-6EA8-405E-B1AF-7C787DD6728B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_2000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "140AF13E-4463-478B-AA94-97406A80CB86",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_5000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "050982D6-BB38-44D0-B67E-73DE9E7567AC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_5000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1356861D-E6CA-4973-9597-629507E8C07E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge-100b_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "61DE4E07-253D-44FD-93A4-3750603B44AC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge-100b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "07E7851F-3E72-4677-B907-CF777EBED2FF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_cloud_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "32A4CEAC-97A4-4A0A-BEF1-B015FBE4E6FF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud:-:*:*:*:*:*:*:*",
"matchCriteriaId": "94999112-9EAA-4707-B002-F867D7628C49",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the vDaemon process of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient handling of malformed packets. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el proceso vDaemon de Cisco SD-WAN Software, podr\u00eda permitir a un atacante remoto no autenticado causar la recarga de un dispositivo, resultando en una condici\u00f3n de denegaci\u00f3n de servicio (DoS).\u0026#xa0;Esta vulnerabilidad es debido al manejo insuficiente de paquetes malformados.\u0026#xa0;Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo tr\u00e1fico dise\u00f1ado hacia un dispositivo afectado.\u0026#xa0;Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante causar que el dispositivo se recargue, resultando en una condici\u00f3n de DoS"
}
],
"id": "CVE-2021-1513",
"lastModified": "2024-11-21T05:44:31.207",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-06T13:15:10.850",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dos-Ckn5cVqW"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dos-Ckn5cVqW"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-09-30 19:15
Modified
2024-11-21 06:43
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Summary
A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitrary files from the file system of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary file path information when using commands in the CLI of an affected device. A successful exploit could allow the attacker to delete arbitrary files from the file system of the affected device.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | sd-wan_vbond_orchestrator | * | |
| cisco | sd-wan_vmanage | * | |
| cisco | sd-wan_vsmart_controller | * | |
| cisco | ios_xe_sd-wan | * | |
| cisco | sd-wan | * | |
| cisco | 1100-4g_integrated_services_router | - | |
| cisco | 1100-6g_integrated_services_router | - | |
| cisco | 1100_integrated_services_router | - | |
| cisco | vedge_100 | - | |
| cisco | vedge_1000 | - | |
| cisco | vedge_100b | - | |
| cisco | vedge_100m | - | |
| cisco | vedge_2000 | - | |
| cisco | vedge_5000 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D3970BA7-2CD6-4DC1-BEBC-03662C88DA94",
"versionEndExcluding": "18.4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9A3197B1-2306-4B0B-96A2-52BB369EE79C",
"versionEndExcluding": "18.4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "12016C30-65D9-4508-B138-0F612736CBF2",
"versionEndExcluding": "18.4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe_sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "052AA171-9B26-4D76-ADA5-1984759AEFB6",
"versionEndExcluding": "16.10.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6A94AB84-87A9-47FB-B3CB-55282536B006",
"versionEndExcluding": "18.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F77CD6A-83DA-4F31-A128-AD6DAECD623B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B68B363-3C57-4E95-8B13-0F9B59D551F7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1952B64C-4AE0-4CCB-86C5-8D1FF6A12822",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "00AAB4DD-1C45-412F-84AA-C056A0BBFB9A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F019975D-3A45-4522-9CB9-F4258C371DF6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0811E0B5-889E-451E-B754-A8FEE32BDFA2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m:-:*:*:*:*:*:*:*",
"matchCriteriaId": "36973815-F46D-4ADA-B9DF-BCB70AC60BD3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "140AF13E-4463-478B-AA94-97406A80CB86",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1356861D-E6CA-4973-9597-629507E8C07E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitrary files from the file system of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary file path information when using commands in the CLI of an affected device. A successful exploit could allow the attacker to delete arbitrary files from the file system of the affected device."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la CLI del software Cisco IOS XE SD-WAN independiente y del software Cisco SD-WAN podr\u00eda permitir a un atacante local autenticado eliminar archivos arbitrarios del sistema de archivos de un dispositivo afectado. Esta vulnerabilidad es debido a una insuficiente comprobaci\u00f3n de entradas. Un atacante podr\u00eda explotar esta vulnerabilidad al inyectar informaci\u00f3n de ruta de archivos arbitraria cuando son usados comandos en la CLI de un dispositivo afectado. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante eliminar archivos arbitrarios del sistema de archivos del dispositivo afectado"
}
],
"id": "CVE-2022-20850",
"lastModified": "2024-11-21T06:43:41.000",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-09-30T19:15:12.543",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-arb-file-delete-VB2rVcQv"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-arb-file-delete-VB2rVcQv"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 20:15
Modified
2024-11-21 05:43
Severity ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | sd-wan_firmware | 18.2.0 | |
| cisco | sd-wan_firmware | 18.3.0 | |
| cisco | sd-wan_firmware | 18.3.8 | |
| cisco | sd-wan_firmware | 18.4.6 | |
| cisco | sd-wan_firmware | 19.2.3 | |
| cisco | sd-wan_firmware | 19.2.99 | |
| cisco | sd-wan_firmware | 20.1.0 | |
| cisco | sd-wan_vsmart_controller_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AF0E7F2D-6999-4FCD-A922-B57070FD9BCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B2C163B3-5B5D-4216-91FC-42757E3A680D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4CBD6FD9-84EE-416C-B77D-843D2FAAF1BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A04E45E9-9905-4FBC-B632-5EF429F6FC52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "478B7BB3-6358-46F6-8F59-786BA8D2AF5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.99:*:*:*:*:*:*:*",
"matchCriteriaId": "B74606C6-B292-4D23-8652-5CF49BDD8369",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:20.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF9C5E2-1A91-43A0-8F51-05A2E204BF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en los productos Cisco SD-WAN, podr\u00edan permitir a un atacante autenticado llevar a cabo ataques de inyecci\u00f3n de comandos contra un dispositivo afectado, lo que podr\u00eda permitirle al atacante tomar determinadas acciones con privilegios root en el dispositivo. Para m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
}
],
"id": "CVE-2021-1261",
"lastModified": "2024-11-21T05:43:57.127",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2,
"source": "ykramarz@cisco.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T20:15:14.800",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 20:15
Modified
2024-11-21 05:43
Severity ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | sd-wan_firmware | 18.2.0 | |
| cisco | sd-wan_firmware | 18.3.0 | |
| cisco | sd-wan_firmware | 18.3.8 | |
| cisco | sd-wan_firmware | 18.4.6 | |
| cisco | sd-wan_firmware | 19.2.3 | |
| cisco | sd-wan_firmware | 19.2.99 | |
| cisco | sd-wan_firmware | 20.1.0 | |
| cisco | sd-wan_vsmart_controller_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AF0E7F2D-6999-4FCD-A922-B57070FD9BCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B2C163B3-5B5D-4216-91FC-42757E3A680D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4CBD6FD9-84EE-416C-B77D-843D2FAAF1BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A04E45E9-9905-4FBC-B632-5EF429F6FC52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "478B7BB3-6358-46F6-8F59-786BA8D2AF5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.99:*:*:*:*:*:*:*",
"matchCriteriaId": "B74606C6-B292-4D23-8652-5CF49BDD8369",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:20.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF9C5E2-1A91-43A0-8F51-05A2E204BF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en los productos Cisco SD-WAN, podr\u00edan permitir a un atacante autenticado llevar a cabo ataques de inyecci\u00f3n de comandos contra un dispositivo afectado, lo que podr\u00eda permitirle al atacante tomar determinadas acciones con privilegios root en el dispositivo. Para m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
}
],
"id": "CVE-2021-1260",
"lastModified": "2024-11-21T05:43:56.993",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2,
"source": "ykramarz@cisco.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T20:15:14.643",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 20:15
Modified
2024-11-21 05:44
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system, gain access to sensitive information, and view information that they are not authorized to access. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | ios_xe_sd-wan | - | |
| cisco | sd-wan_firmware | * | |
| cisco | sd-wan_firmware | 20.4.0 | |
| cisco | sd-wan_vsmart_controller_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xe_sd-wan:-:*:*:*:*:*:*:*",
"matchCriteriaId": "16266B9E-E613-45FA-A02B-51EED8BEFCC9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ADFA9DB8-3168-467D-8EE7-2368C072142E",
"versionEndExcluding": "20.3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:20.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "12CB625A-C638-414A-95F9-9E147C897C60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system, gain access to sensitive information, and view information that they are not authorized to access. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en la interfaz de administraci\u00f3n basada en web del Software Cisco SD-WAN vManage, podr\u00edan permitir a un atacante remoto autenticado omitir la autorizaci\u00f3n y modificar la configuraci\u00f3n de un sistema afectado, conseguir acceso a informaci\u00f3n confidencial y visualizar informaci\u00f3n para la que no est\u00e1 autorizado acceder. Para m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
}
],
"id": "CVE-2021-1305",
"lastModified": "2024-11-21T05:44:03.123",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T20:15:17.207",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-abyp-TnGFHrS"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-abyp-TnGFHrS"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-09-30 19:15
Modified
2024-11-21 06:43
Severity ?
6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite and possibly corrupt files on an affected system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary commands that are executed as the root user account. A successful exploit could allow the attacker to overwrite arbitrary system files, which could result in a denial of service (DoS) condition.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | catalyst_sd-wan_manager | 20.8 | |
| cisco | catalyst_sd-wan_manager | 20.9 | |
| cisco | sd-wan_vbond_orchestrator | * | |
| cisco | sd-wan_vbond_orchestrator | 20.8 | |
| cisco | sd-wan_vbond_orchestrator | 20.9 | |
| cisco | sd-wan_vmanage | * | |
| cisco | sd-wan_vsmart_controller | * | |
| cisco | sd-wan_vsmart_controller | 20.8 | |
| cisco | sd-wan_vsmart_controller | 20.9 | |
| cisco | sd-wan | * | |
| cisco | sd-wan | 20.8 | |
| cisco | sd-wan | 20.9 | |
| cisco | vedge_100 | - | |
| cisco | vedge_1000 | - | |
| cisco | vedge_100b | - | |
| cisco | vedge_100m | - | |
| cisco | vedge_100wm | - | |
| cisco | vedge_2000 | - | |
| cisco | vedge_5000 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.8:*:*:*:*:*:*:*",
"matchCriteriaId": "0493FE21-BB5A-41D3-9EBD-2C2BD165D5CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.9:*:*:*:*:*:*:*",
"matchCriteriaId": "14E0AF41-0322-4F59-A2E2-DF709FC365E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D46A4FAD-C08D-434F-8F34-7256196AC215",
"versionEndExcluding": "20.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:20.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B62FF06E-8A11-41B5-B67C-9C008B5832F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:20.9:*:*:*:*:*:*:*",
"matchCriteriaId": "0FB7C1FF-B18D-47CA-BC1A-34C0029DC2AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1885D68A-547F-4C24-AE92-9F0D620E2018",
"versionEndExcluding": "20.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1032BCB0-0343-46C3-A094-A484551D6DD5",
"versionEndExcluding": "20.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.8:*:*:*:*:*:*:*",
"matchCriteriaId": "D65F88EF-F2A8-4798-A88B-5B0584760E7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.9:*:*:*:*:*:*:*",
"matchCriteriaId": "E74B8658-FF4B-4DBA-AADA-73655B76339A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7E43D23-7294-4CCC-8B7C-D9231115CA61",
"versionEndExcluding": "20.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan:20.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8CEAD0DC-6407-4D23-A73D-0089C31CEB39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan:20.9:*:*:*:*:*:*:*",
"matchCriteriaId": "25734138-B0A8-41C1-B7C4-6D1B011C4FBC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "00AAB4DD-1C45-412F-84AA-C056A0BBFB9A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F019975D-3A45-4522-9CB9-F4258C371DF6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0811E0B5-889E-451E-B754-A8FEE32BDFA2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m:-:*:*:*:*:*:*:*",
"matchCriteriaId": "36973815-F46D-4ADA-B9DF-BCB70AC60BD3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "061A302C-8D35-4E80-93DA-916DA7E90C06",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "140AF13E-4463-478B-AA94-97406A80CB86",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1356861D-E6CA-4973-9597-629507E8C07E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite and possibly corrupt files on an affected system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary commands that are executed as the root user account. A successful exploit could allow the attacker to overwrite arbitrary system files, which could result in a denial of service (DoS) condition."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la CLI del software Cisco SD-WAN podr\u00eda permitir a un atacante local autenticado sobrescribir y posiblemente corromper archivos en un sistema afectado. Esta vulnerabilidad es debido a que la comprobaci\u00f3n de entradas es insuficiente. Un atacante podr\u00eda explotar esta vulnerabilidad al inyectar comandos arbitrarios que son ejecutados como la cuenta de usuario root. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante sobrescribir archivos arbitrarios del sistema, lo que podr\u00eda resultar en una condici\u00f3n de denegaci\u00f3n de servicio (DoS)"
}
],
"id": "CVE-2022-20930",
"lastModified": "2024-11-21T06:43:50.820",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.8,
"impactScore": 5.9,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-09-30T19:15:13.557",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-cli-xkGwmqKu"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-cli-xkGwmqKu"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-88"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-06-04 17:15
Modified
2024-11-21 05:44
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulnerability exists because the affected software does not properly restrict access to privileged processes. An attacker could exploit this vulnerability by invoking a privileged process in the affected system. A successful exploit could allow the attacker to perform actions with the privileges of the root user.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0ABABC6A-BE28-4107-A00F-E6D8841168F5",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE2C4782-DD4D-4113-A367-13DA609AD5F4",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C8099190-F1EC-4AFC-9607-5F13E09B7C26",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3079495E-BB87-48EF-92F2-5C0DFBBDFB2D",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:vsmart_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A234D95C-0AC1-4183-8457-550932E10B7E",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:vsmart_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9E3634B4-6146-4DF5-B242-6606F6CCBA00",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4E75BF8E-8BA5-4A53-9CE9-F10CC245FFC3",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B89D5AE2-3ED3-4C57-AF93-E9750D38F029",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "00AAB4DD-1C45-412F-84AA-C056A0BBFB9A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6916F5F8-4E5B-4878-9C08-430F30EB61FD",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "834192CC-585D-445E-B2AD-D73E9CDF3FED",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F019975D-3A45-4522-9CB9-F4258C371DF6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1D0C212A-DDCE-4D44-8D2A-8A7DEC4C30E2",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "632EBFCA-132A-4AC9-A244-7D6EBCAEAC16",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0811E0B5-889E-451E-B754-A8FEE32BDFA2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100m_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C7B4CFA5-743E-4A04-9FED-CB9A5F587192",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100m_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6375DFCF-2EEB-482B-AAD4-8FAB8F03C9C0",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100m:-:*:*:*:*:*:*:*",
"matchCriteriaId": "36973815-F46D-4ADA-B9DF-BCB70AC60BD3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100wm_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA09C6C5-B770-4C42-8DE0-4482D7FC5512",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100wm_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "104BBAE4-C7C1-4E5A-A540-AF679FCE1CD2",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "061A302C-8D35-4E80-93DA-916DA7E90C06",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E609583F-9F2E-435A-88A3-77950F3825BD",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "584863D2-B181-4CDF-8266-EEBA56A5AA85",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_2000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "140AF13E-4463-478B-AA94-97406A80CB86",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "39F5B972-D194-4333-BEF6-129BEBB61E9E",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "50C0D971-E2C4-4048-A08F-0A5D437866F8",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_5000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1356861D-E6CA-4973-9597-629507E8C07E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1D0C212A-DDCE-4D44-8D2A-8A7DEC4C30E2",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "632EBFCA-132A-4AC9-A244-7D6EBCAEAC16",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0811E0B5-889E-451E-B754-A8FEE32BDFA2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_cloud_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E8696F30-DB2C-46D8-99BF-68A3D3AC0988",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_cloud_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DDBBDE43-BBAE-431B-AF56-73D9CC8743F7",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud:-:*:*:*:*:*:*:*",
"matchCriteriaId": "94999112-9EAA-4707-B002-F867D7628C49",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulnerability exists because the affected software does not properly restrict access to privileged processes. An attacker could exploit this vulnerability by invoking a privileged process in the affected system. A successful exploit could allow the attacker to perform actions with the privileges of the root user."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la CLI del Software Cisco SD-WAN, podr\u00eda permitir a un atacante local autenticado alcanzar privilegios elevados en un sistema afectado. Esta vulnerabilidad se presenta porque el software afectado no restringe apropiadamente el acceso a los procesos con privilegios. Un atacante podr\u00eda explotar esta vulnerabilidad al invocar un proceso privilegiado en el sistema afectado. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante llevar a cabo acciones con los privilegios del usuario root"
}
],
"id": "CVE-2021-1528",
"lastModified": "2024-11-21T05:44:33.277",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-04T17:15:09.020",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-fuErCWwF"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-fuErCWwF"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-250"
}
],
"source": "ykramarz@cisco.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-09-23 03:15
Modified
2024-11-21 05:44
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to improper protections on file access through the CLI. An attacker could exploit this vulnerability by running a CLI command that targets an arbitrary file on the local system. A successful exploit could allow the attacker to return portions of an arbitrary file, possibly resulting in the disclosure of sensitive information.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3A19C57E-75A5-47AA-94B7-A7ADC2CD7091",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D860DAF6-2876-4F54-ACBF-B217E709BD7F",
"versionEndExcluding": "20.6.1",
"versionStartIncluding": "20.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9F397362-BB17-4F5E-AFA3-B604A96C7BAE",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "15F9C222-75A1-44F8-A726-46CA77430D2F",
"versionEndExcluding": "20.5.2",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F05A7552-5CFC-47EE-BA6B-98D423761369",
"versionEndExcluding": "20.6.1",
"versionStartIncluding": "20.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DC5C7C68-74C1-4D7F-848B-16C8566C0F42",
"versionEndExcluding": "20.5.2",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D99340DC-B83C-4F81-969F-C0A6E7CC4A54",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "918ACCD9-0F3F-4EF3-8C0A-AE30F69BC8E9",
"versionEndExcluding": "20.5.2",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6A923BEA-61C4-4A2E-A7DD-BB389FF661CB",
"versionEndExcluding": "20.6.1",
"versionStartIncluding": "20.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vsmart_controller:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FF370668-127C-409B-83FE-293B830D4FB4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F7887226-3051-4914-8B0E-5DF4296AB68E",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "210F5970-F029-4E1F-97E4-0813F78CA88C",
"versionEndExcluding": "20.5.2",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "99B58689-4FDF-4811-B1EE-584F777B696D",
"versionEndExcluding": "20.6.1",
"versionStartIncluding": "20.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "00AAB4DD-1C45-412F-84AA-C056A0BBFB9A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F443A171-E27A-4173-BB09-77E0A1587CE6",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "047C57D1-C8B3-46F2-8B02-8467AF57D71A",
"versionEndExcluding": "20.5.2",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2FF65836-25C3-46C7-8989-9ABF3069D13F",
"versionEndExcluding": "20.6.1",
"versionStartIncluding": "20.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F019975D-3A45-4522-9CB9-F4258C371DF6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "61682805-F527-473D-970A-B68053889AC8",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B1ECE5A2-ED32-4453-A0FC-78A3D0D4F554",
"versionEndExcluding": "20.5.2",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E3A99ECD-E6FE-4BF8-BE6D-22005B5E387A",
"versionEndExcluding": "20.6.1",
"versionStartIncluding": "20.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0811E0B5-889E-451E-B754-A8FEE32BDFA2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100m_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3E00BBD5-A34A-47EF-9BCA-7100D2282A72",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100m_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F42BACEF-31BE-4FEF-8BD3-8EC2D5A59194",
"versionEndExcluding": "20.5.2",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100m_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "00A3ECC6-E30A-4611-9872-8C6133F4A0C6",
"versionEndExcluding": "20.6.1",
"versionStartIncluding": "20.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100m:-:*:*:*:*:*:*:*",
"matchCriteriaId": "36973815-F46D-4ADA-B9DF-BCB70AC60BD3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100wm_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "449AC46F-BE53-4706-A448-83A848492637",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100wm_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "42659BBF-8707-4DAC-8A5D-0E9DC10DD68F",
"versionEndExcluding": "20.5.2",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100wm_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D9899709-00DD-4934-9A54-3FDB171C2E74",
"versionEndExcluding": "20.6.1",
"versionStartIncluding": "20.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "061A302C-8D35-4E80-93DA-916DA7E90C06",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A27667C1-0EF2-419D-A216-83FBC3F5A61E",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6954D048-EE8D-4923-9F10-18FD941AF72A",
"versionEndExcluding": "20.5.2",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "95ED1F5D-5573-4886-A875-10DD93AE495B",
"versionEndExcluding": "20.6.1",
"versionStartIncluding": "20.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_2000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "140AF13E-4463-478B-AA94-97406A80CB86",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FB95804D-0357-4F33-ABB2-AB04C34D3095",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DAE58206-30C8-4734-B5BB-1FD631351F49",
"versionEndExcluding": "20.5.2",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BCB1732D-73DA-4125-A2FE-A79435B550AC",
"versionEndExcluding": "20.6.1",
"versionStartIncluding": "20.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_5000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1356861D-E6CA-4973-9597-629507E8C07E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_cloud_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "56637DFC-FD0A-4714-9988-2DE80B3FB7BE",
"versionEndExcluding": "20.4.2",
"versionStartIncluding": "18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_cloud_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "00C2DEED-5833-4E13-BBB3-5E5FE837979D",
"versionEndExcluding": "20.5.2",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_cloud_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6BF84BFB-E819-4C59-B16D-B00508218CE3",
"versionEndExcluding": "20.6.1",
"versionStartIncluding": "20.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud:-:*:*:*:*:*:*:*",
"matchCriteriaId": "94999112-9EAA-4707-B002-F867D7628C49",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to improper protections on file access through the CLI. An attacker could exploit this vulnerability by running a CLI command that targets an arbitrary file on the local system. A successful exploit could allow the attacker to return portions of an arbitrary file, possibly resulting in the disclosure of sensitive information."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la CLI de Cisco SD-WAN Software podr\u00eda permitir a un atacante local autenticado acceder a informaci\u00f3n confidencial. Esta vulnerabilidad es debido a protecciones inapropiadas en el acceso a archivos mediante la CLI. Un atacante podr\u00eda explotar esta vulnerabilidad al ejecutar un comando de la CLI que tenga como objetivo un archivo arbitrario en el sistema local. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante devolver porciones de un archivo arbitrario, posiblemente resultando en una divulgaci\u00f3n de informaci\u00f3n confidencial"
}
],
"id": "CVE-2021-1546",
"lastModified": "2024-11-21T05:44:35.523",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-09-23T03:15:11.183",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-Fhqh8pKX"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-Fhqh8pKX"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 21:15
Modified
2024-11-21 05:43
Severity ?
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information on an affected device. The vulnerability is due to insufficient input validation of requests that are sent to the iperf tool. An attacker could exploit this vulnerability by sending a crafted request to the iperf tool, which is included in Cisco SD-WAN Software. A successful exploit could allow the attacker to obtain any file from the filesystem of an affected device.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | sd-wan_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7A859F83-EE40-4E63-9F51-9DF643CBFEAB",
"versionEndExcluding": "18.4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information on an affected device. The vulnerability is due to insufficient input validation of requests that are sent to the iperf tool. An attacker could exploit this vulnerability by sending a crafted request to the iperf tool, which is included in Cisco SD-WAN Software. A successful exploit could allow the attacker to obtain any file from the filesystem of an affected device."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la CLI del Software Cisco SD-WAN, podr\u00eda permitir a un atacante local autenticado acceder a informaci\u00f3n confidencial en un dispositivo afectado. La vulnerabilidad es debido a una comprobaci\u00f3n insuficiente de la entrada de las peticiones que son enviadas hacia la herramienta iperf. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de una petici\u00f3n dise\u00f1ada a la herramienta iperf, que se incluye en el Software Cisco SD-WAN. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante obtener cualquier archivo del sistema de archivos de un dispositivo afectado"
}
],
"id": "CVE-2021-1233",
"lastModified": "2024-11-21T05:43:53.390",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 0.8,
"impactScore": 3.6,
"source": "ykramarz@cisco.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 0.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T21:15:11.943",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-infodis-2-UPO232DG"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-infodis-2-UPO232DG"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 20:15
Modified
2024-11-21 05:44
Severity ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | ios_xe_sd-wan | - | |
| cisco | sd-wan_firmware | 18.3.8 | |
| cisco | sd-wan_firmware | 18.4.4 | |
| cisco | sd-wan_firmware | 19.2.1 | |
| cisco | sd-wan_firmware | 19.2.99 | |
| cisco | sd-wan_vsmart_controller_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xe_sd-wan:-:*:*:*:*:*:*:*",
"matchCriteriaId": "16266B9E-E613-45FA-A02B-51EED8BEFCC9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4CBD6FD9-84EE-416C-B77D-843D2FAAF1BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F4C9F1DA-0527-4442-B0B4-4467960D30C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9C535AB3-DCCE-4CFB-8479-08550552E863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.99:*:*:*:*:*:*:*",
"matchCriteriaId": "B74606C6-B292-4D23-8652-5CF49BDD8369",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en los productos Cisco SD-WAN, podr\u00edan permitir a un atacante no autenticado remoto ejecutar ataques contra un dispositivo afectado. Para m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
}
],
"id": "CVE-2021-1300",
"lastModified": "2024-11-21T05:44:02.410",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "ykramarz@cisco.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T20:15:16.800",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-04-15 15:15
Modified
2024-11-21 06:43
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper access control on files within the affected system. A local attacker could exploit this vulnerability by modifying certain files on the vulnerable device. If successful, the attacker could gain escalated privileges and take actions on the system with the privileges of the root user.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_solution | - | |
| cisco | sd-wan_vbond_orchestrator | - | |
| cisco | sd-wan_vedge_cloud | - | |
| cisco | sd-wan_vedge_router | - | |
| cisco | sd-wan_vsmart_controller_software | - | |
| cisco | sd-wan | * | |
| cisco | sd-wan | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_solution:-:*:*:*:*:*:*:*",
"matchCriteriaId": "264691E8-B9EE-445B-AA73-339E2AD9D75A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vedge_cloud:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F79EFC51-42F0-4E00-9993-2CBD852BB7EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vedge_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E751F057-CC4E-49AF-BFFE-1C08A0AFEDBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vsmart_controller_software:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5C1E3D19-7A59-41DA-A216-814E6AB697B5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "633B8D51-C333-4C34-BE6B-4A95BA0A0E20",
"versionEndExcluding": "20.6.1",
"versionStartIncluding": "18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "71DFA673-7836-4EC9-9B73-428598BC012D",
"versionEndExcluding": "20.7.1",
"versionStartIncluding": "20.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper access control on files within the affected system. A local attacker could exploit this vulnerability by modifying certain files on the vulnerable device. If successful, the attacker could gain escalated privileges and take actions on the system with the privileges of the root user."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la CLI del software Cisco SD-WAN podr\u00eda permitir a un atacante local autenticado alcanzar altos privilegios. Esta vulnerabilidad es debido a un control de acceso inapropiado en los archivos del sistema afectado. Un atacante local podr\u00eda explotar esta vulnerabilidad al modificar determinados archivos en el dispositivo vulnerable. Si es exitoso, el atacante podr\u00eda alcanzar privilegios escalados y realizar acciones en el sistema con privilegios de usuario root"
}
],
"id": "CVE-2022-20716",
"lastModified": "2024-11-21T06:43:23.910",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-04-15T15:15:13.063",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-file-access-VW36d28P"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-file-access-VW36d28P"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-09-30 19:15
Modified
2024-11-21 06:43
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "907DC50A-5624-413C-A61F-157B2B1E52BE",
"versionEndExcluding": "20.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1F48596B-7315-4FF0-A91A-25B6AA94955B",
"versionEndExcluding": "20.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A6AC232B-0AF3-4B67-B080-72944C42CAE9",
"versionEndExcluding": "20.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*",
"matchCriteriaId": "070EBD00-E21A-4510-BE38-A935E788FA39",
"versionEndExcluding": "20.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_8000v_edge:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF365FC4-46E3-4564-9F25-1C2FBE70057B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_cg418-e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "36AFCB37-1760-4808-AEA5-875F45C05464",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_cg522-e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C146F67C-0FCF-4C5C-B6B8-D67746E69CFB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F77CD6A-83DA-4F31-A128-AD6DAECD623B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2D2305B-B69E-4F74-A44E-07B3205CE9F7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B68B363-3C57-4E95-8B13-0F9B59D551F7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "26DD41B3-1D1D-44D3-BA8E-5A66AFEE77E6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1952B64C-4AE0-4CCB-86C5-8D1FF6A12822",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5AAD4397-6DCF-493A-BD61-3A890F6F3AB2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5EB8A757-7888-4AC2-BE44-B89DB83C6C77",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3F2F0A8E-97F6-41AC-BE67-4B2D60F9D36B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BB9229F3-7BCE-46C4-9879-D57B5BAAE44E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B80890A8-E3D3-462C-B125-9E9BC6525B02",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A5A606FE-E6F1-43F9-B1CD-D9DF35FC3573",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1111x_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0547E196-5991-4C33-823A-342542E9DFD3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:111x_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "802CBFC1-8A2F-4BF7-A1D3-00622C33BE16",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7AFE0FC1-EEBC-42F0-88B0-4AF5B76DDD97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F3F374DC-B9F7-4515-A064-01BB436CA984",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D916389F-54DB-44CB-91DD-7CE3C7059350",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4000_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CE82335E-ECEC-47BD-BC4A-5FDEA08D1A18",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6C8AED7C-DDA3-4C29-BB95-6518C02C551A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4321\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05C90C43-2D7D-43F8-AD7F-421878909AE2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4321\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "445597DA-7EEC-470D-9A71-BC43A9F7DE5E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4321\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "86049773-C88D-4A26-A0D3-D40F3C312AEC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9421DBEF-AE42-4234-B49F-FCC34B804D7F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4331\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6AB4B7C2-4D45-4267-BCBB-57D36C6104A3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4331\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B8A4630-8B21-4994-8EF5-E105593A64E5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4331\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F799DC02-EB06-458C-8545-A174475FE7A2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5419CB9F-241F-4431-914F-2659BE27BEA5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4351\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B89FBA68-A8ED-4C5A-916E-A68468F59730",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4351\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD272E6E-2ED1-4408-8FF7-0B82F9DCBEF8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4351\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DC278B77-AD63-42AD-B9E8-EE4DE97E27E9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4351_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7DE02DBE-EAD5-4F37-8AB7-DF46A605A0E2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5720462A-BE6B-4E84-A1A1-01E80BBA86AD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "818CEFA6-208C-43C3-8E43-474A93ADCF21",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4451_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "82225D40-537F-41D2-B1C4-1B7D06466B06",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8B60888-6E2B-494E-AC65-83337661EE7D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8101-32fh:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E055F58F-F9FB-4B27-841E-61ECAB5F42B8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8101-32h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B832863-E366-46ED-BC35-838762F0CE29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8102-64h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A3C3DDAC-7D0F-4D1D-9632-F001F2EB5D34",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3D8E7FFF-82A8-4ECB-BA0C-CBF0C2FDA3A3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8201-32fh:-:*:*:*:*:*:*:*",
"matchCriteriaId": "528BE0D3-E5ED-4836-B0D8-0C8508C5BDD7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87DC4C2F-01C5-4D89-8D79-E5D28EDAD0F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8804:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6655851F-58D9-49D9-A56E-8440A7F7BB45",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8808:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5E2AE67-DED3-4414-A194-386ADB2C8DC7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8812:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3920133A-684D-4A9F-B65A-FF4EAE5052E5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8818:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9ED06361-5A68-4656-AEA5-240C290594CD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BE2514A1-486C-40F7-8746-56E2B973CBE6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "91209C16-A620-44A0-9134-8AA456343F29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE2182E7-C813-4966-A36C-E648A9344299",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*",
"matchCriteriaId": "ED7C321E-F083-4AB6-96A0-D6358980441E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7594E307-AC80-41EC-AE94-07E664A7D701",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1001-hx_r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33208B25-0CBB-4E31-A892-60B7B5625155",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "09C913FF-63D5-43FB-8B39-598EF436BA5A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1001-x_r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "241EEBD9-76E4-4AE6-96B8-1C1ACD834F17",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E4376E56-A21C-4642-A85D-439C8E21CD7F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD2794BD-C8CE-46EF-9857-1723FCF04E46",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1002-hx_r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CC03A84F-C8F2-4225-9A00-8FA35368CD57",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "444F688F-79D0-4F22-B530-7BD520080B8F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1002-x_r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "51F2A755-556C-4C5E-8622-96D124319AF7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "55DD2272-10C2-43B9-9F13-6DC41DBE179B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7428E0A8-1641-47FB-9CA9-34311DEF660D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DE7401B7-094C-46EB-9869-2F0372E8B26B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8D8A72FD-D8B0-45B5-8FAD-6D8395BB218A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*",
"matchCriteriaId": "854D9594-FE84-4E7B-BA21-A3287F2DC302",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C81CC6E3-B989-4730-820E-46734E3E608D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EE9EABE0-5FB0-4277-A389-87732E750B7C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8300:-:*:*:*:*:*:*:*",
"matchCriteriaId": "72BBF8E8-7AD9-46B8-8B02-F0DB1F95E1CD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8300-1n1s-4t2x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5E7E8914-7B25-4097-8B22-6928C1F03D5A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8300-1n1s-6t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B207857B-C483-47DF-9FC7-6A05B866BF60",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8300-2n2s-4t2x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD26746A-80D1-4C48-BF77-E9F7EEEF7EA7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8300-2n2s-6t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BDB16CCE-1E89-4707-86C1-97F2FB5B62B9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7A82CE19-C3C4-4FAD-A1B3-AB91EDB61591",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8500-4qc:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A1DBA393-232D-40E6-9CDB-DF82D2E7A5B6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8500l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "04AB61E9-0148-495E-BD21-64D52DE60A6C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8510csr:-:*:*:*:*:*:*:*",
"matchCriteriaId": "85D2C587-E95B-4E74-88CF-5930072258D3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8510msr:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D3D1BB0B-0EFE-4C6D-A18E-3E48ABA01F00",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8540csr:-:*:*:*:*:*:*:*",
"matchCriteriaId": "74270062-2030-45A0-9C93-C1F3B7C88E8B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_8540msr:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F403859-F034-4DD9-9CA5-708EADECB380",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en la CLI del software Cisco SD-WAN podr\u00edan permitir a un atacante local autenticado conseguir altos privilegios. Estas vulnerabilidades son debido a controles de acceso inapropiados en los comandos dentro de la aplicaci\u00f3n CLI. Un atacante podr\u00eda explotar estas vulnerabilidades al ejecutar un comando malicioso en la CLI de la aplicaci\u00f3n. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante ejecutar comandos arbitrarios como usuario root"
}
],
"id": "CVE-2022-20818",
"lastModified": "2024-11-21T06:43:36.913",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-09-30T19:15:11.867",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-25"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 20:15
Modified
2024-11-21 05:44
Severity ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | ios_xe_sd-wan | - | |
| cisco | sd-wan_firmware | 18.3.8 | |
| cisco | sd-wan_firmware | 18.4.4 | |
| cisco | sd-wan_firmware | 19.2.1 | |
| cisco | sd-wan_firmware | 19.2.99 | |
| cisco | sd-wan_vsmart_controller_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xe_sd-wan:-:*:*:*:*:*:*:*",
"matchCriteriaId": "16266B9E-E613-45FA-A02B-51EED8BEFCC9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4CBD6FD9-84EE-416C-B77D-843D2FAAF1BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F4C9F1DA-0527-4442-B0B4-4467960D30C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9C535AB3-DCCE-4CFB-8479-08550552E863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.99:*:*:*:*:*:*:*",
"matchCriteriaId": "B74606C6-B292-4D23-8652-5CF49BDD8369",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en los productos Cisco SD-WAN, podr\u00edan permitir a un atacante no autenticado remoto ejecutar ataques contra un dispositivo afectado. Para m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
}
],
"id": "CVE-2021-1301",
"lastModified": "2024-11-21T05:44:02.557",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "ykramarz@cisco.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T20:15:16.877",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-06 13:15
Modified
2024-11-21 05:44
Severity ?
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Administrator privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated as a low-privileged user to execute the affected commands. A successful exploit could allow the attacker to execute commands with Administrator privileges.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "294BFF76-0352-4778-B6DA-3F8D5C69B5EE",
"versionEndExcluding": "20.1.1",
"versionStartIncluding": "20.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3366F4EC-9DCD-44F8-8430-1B3BA7A9B95F",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2D155FE-14C5-4658-A5D4-974DCE7FED4F",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE2C4782-DD4D-4113-A367-13DA609AD5F4",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DBCB1ED4-B8F6-454A-A50E-1E6C5799A38B",
"versionEndExcluding": "18.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "52660B0F-9951-4720-9243-C04D19E1C900",
"versionEndExcluding": "20.1.1",
"versionStartIncluding": "20.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "43CB0C13-B19C-4716-9079-E3187C6A8F60",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5CBDDA10-0C6A-4AE2-A79D-6ACE91BCE422",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3079495E-BB87-48EF-92F2-5C0DFBBDFB2D",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CA56832C-0BA7-49F8-B03D-F7A8DDBA2D76",
"versionEndExcluding": "18.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9F385B4-A7C9-4964-9A2F-9B246C2A4219",
"versionEndExcluding": "18.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "35D792D2-7C42-4E49-A024-7D8F10A5CD03",
"versionEndExcluding": "20.1.1",
"versionStartIncluding": "20.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "89290824-9E80-4DA6-B943-500A9DC80EF4",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "57361E3C-D8AD-4971-8015-96B8910B847D",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6B61FD2-6C23-4A1A-AED4-CAD54D0715C4",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vsmart_controller:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FF370668-127C-409B-83FE-293B830D4FB4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7E03063D-9DB6-4D3A-8FFF-C530635371CC",
"versionEndExcluding": "18.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "43E988F6-8D4D-4E75-9C43-31E92AA3F85A",
"versionEndExcluding": "20.1.1",
"versionStartIncluding": "20.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0C67D65F-5DBD-4DCE-84CF-F1F2FBA4A250",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7BFED2F3-4C18-4BE5-9F97-2CFCE37E7A2E",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B89D5AE2-3ED3-4C57-AF93-E9750D38F029",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "00AAB4DD-1C45-412F-84AA-C056A0BBFB9A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BBF226AE-FF8F-4203-8DAC-438E82AEC85A",
"versionEndExcluding": "18.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1AD6B70F-1356-4AB4-A8DB-6BB3BAD854A6",
"versionEndExcluding": "20.1.1",
"versionStartIncluding": "20.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "669F7796-2CBF-42BF-91C4-F861DF09D4B7",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "50C849A5-EBF4-4CD7-93AE-503C3E0B7A05",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "834192CC-585D-445E-B2AD-D73E9CDF3FED",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F019975D-3A45-4522-9CB9-F4258C371DF6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9A5A7F2E-0B61-4C4C-AE1F-BAFB735DA905",
"versionEndExcluding": "18.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1158B505-4DAC-42BB-A9E5-533BCA7545F4",
"versionEndExcluding": "20.1.1",
"versionStartIncluding": "20.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "427DC9A5-3374-440C-A797-DC7BBCCCB13D",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "12136AD8-9113-46B9-B6A9-0C330ABB05B9",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "632EBFCA-132A-4AC9-A244-7D6EBCAEAC16",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0811E0B5-889E-451E-B754-A8FEE32BDFA2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100m_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2E77822B-DEF3-44C3-9AFE-A406ECD26EE5",
"versionEndExcluding": "18.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100m_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9A4C603C-9858-4048-AA20-7C7F7BB84DBD",
"versionEndExcluding": "20.1.1",
"versionStartIncluding": "20.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100m_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A51AE026-39C0-400B-8E78-21ACBF6D560F",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100m_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "829BA8C4-8E99-4338-817B-9F9FF37105BE",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100m_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6375DFCF-2EEB-482B-AAD4-8FAB8F03C9C0",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100m:-:*:*:*:*:*:*:*",
"matchCriteriaId": "36973815-F46D-4ADA-B9DF-BCB70AC60BD3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_100wm_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "646D2962-5FB3-45E1-B743-CFDF6219742B",
"versionEndExcluding": "18.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100wm_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B55B533F-0942-4848-A823-8D17BD9C70AC",
"versionEndExcluding": "20.1.1",
"versionStartIncluding": "20.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100wm_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "04BBF912-56A4-4B0D-AEDE-3B4A66E46DC6",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100wm_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "200199EC-2819-4DE0-828C-0F56790CA1B4",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_100wm_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "104BBAE4-C7C1-4E5A-A540-AF679FCE1CD2",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm:-:*:*:*:*:*:*:*",
"matchCriteriaId": "061A302C-8D35-4E80-93DA-916DA7E90C06",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "66F09F72-2D64-4952-8ED1-5B1D8817B065",
"versionEndExcluding": "18.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28170198-23CE-48F9-8502-3C0F51EDCB33",
"versionEndExcluding": "20.1.1",
"versionStartIncluding": "20.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48758B17-6BB7-45BB-AB83-36AF55238250",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E479E1A4-0F80-4FDC-8F9F-9E23A885179A",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "584863D2-B181-4CDF-8266-EEBA56A5AA85",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_2000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "140AF13E-4463-478B-AA94-97406A80CB86",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5488D32F-808B-4327-8C57-13F270C02C1B",
"versionEndExcluding": "18.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7B559B94-0730-4F3D-90AB-E71D2E684C19",
"versionEndExcluding": "20.1.1",
"versionStartIncluding": "20.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2090A040-270A-4BD1-8430-603C709F64E8",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4288CD57-CDEE-4B03-8163-7CDDE7767914",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "50C0D971-E2C4-4048-A08F-0A5D437866F8",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_5000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1356861D-E6CA-4973-9597-629507E8C07E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge-100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7F1B097C-09B1-4DC6-B0F9-92E01C415DF3",
"versionEndExcluding": "18.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge-100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2FA95C6C-72C5-4DDF-B036-5AB2900C9C71",
"versionEndExcluding": "20.1.1",
"versionStartIncluding": "20.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge-100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C8123987-EAD3-47D2-AD9F-167A1D52AEF7",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge-100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "25953689-6E4F-477A-A251-54C1D8ED8880",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge-100b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3414238A-002E-48F7-82DE-FE4122B1A10A",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge-100b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "07E7851F-3E72-4677-B907-CF777EBED2FF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:vedge_cloud_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83F5CAE4-CB80-441B-928D-86C13570AA1B",
"versionEndExcluding": "18.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_cloud_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DC788143-279B-4325-988A-5FBAA4B438CC",
"versionEndExcluding": "20.1.1",
"versionStartIncluding": "20.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_cloud_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2FBE16B1-8E2A-4DF8-B362-86874FAC1F0C",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_cloud_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "430D9FAC-36E8-4AB0-85F2-88D7EF1F6B7A",
"versionEndExcluding": "20.4.1",
"versionStartIncluding": "20.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:vedge_cloud_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DDBBDE43-BBAE-431B-AF56-73D9CC8743F7",
"versionEndExcluding": "20.5.1",
"versionStartIncluding": "20.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud:-:*:*:*:*:*:*:*",
"matchCriteriaId": "94999112-9EAA-4707-B002-F867D7628C49",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Administrator privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated as a low-privileged user to execute the affected commands. A successful exploit could allow the attacker to execute commands with Administrator privileges."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la CLI de Cisco SD-WAN Software, podr\u00eda permitir a un atacante local autenticado inyectar comandos arbitrarios para que sean ejecutados con privilegios de administrador en el Sistema Operativo subyacente.\u0026#xa0;Esta vulnerabilidad es debido a una comprobaci\u00f3n insuficiente de la entrada en determinados comandos de la CLI.\u0026#xa0;Un atacante podr\u00eda explotar esta vulnerabilidad si se autentica en el dispositivo y env\u00eda una entrada dise\u00f1ada a la CLI.\u0026#xa0;El atacante debe estar autenticado como un usuario poco privilegiado para ejecutar los comandos afectados.\u0026#xa0;Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante ejecutar comandos con privilegios de administrador"
}
],
"id": "CVE-2021-1514",
"lastModified": "2024-11-21T05:44:31.353",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.8,
"impactScore": 2.5,
"source": "ykramarz@cisco.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-06T13:15:10.887",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-QVszVUPy"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-QVszVUPy"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 20:15
Modified
2024-11-21 05:44
Severity ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | sd-wan_firmware | 18.2.0 | |
| cisco | sd-wan_firmware | 18.3.0 | |
| cisco | sd-wan_firmware | 18.3.8 | |
| cisco | sd-wan_firmware | 18.4.6 | |
| cisco | sd-wan_firmware | 19.2.3 | |
| cisco | sd-wan_firmware | 19.2.99 | |
| cisco | sd-wan_firmware | 20.1.0 | |
| cisco | sd-wan_vsmart_controller_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AF0E7F2D-6999-4FCD-A922-B57070FD9BCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B2C163B3-5B5D-4216-91FC-42757E3A680D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4CBD6FD9-84EE-416C-B77D-843D2FAAF1BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A04E45E9-9905-4FBC-B632-5EF429F6FC52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "478B7BB3-6358-46F6-8F59-786BA8D2AF5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.99:*:*:*:*:*:*:*",
"matchCriteriaId": "B74606C6-B292-4D23-8652-5CF49BDD8369",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:20.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF9C5E2-1A91-43A0-8F51-05A2E204BF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en los productos Cisco SD-WAN, podr\u00edan permitir a un atacante autenticado llevar a cabo ataques de inyecci\u00f3n de comandos contra un dispositivo afectado, lo que podr\u00eda permitir al atacante tomar determinadas acciones con privilegios root en el dispositivo. Para m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
}
],
"id": "CVE-2021-1299",
"lastModified": "2024-11-21T05:44:02.263",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2,
"source": "ykramarz@cisco.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T20:15:16.720",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 21:15
Modified
2024-11-21 05:43
Severity ?
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | ios_xe_sd-wan | - | |
| cisco | sd-wan_firmware | 18.3.5 | |
| cisco | sd-wan_firmware | 18.3.8 | |
| cisco | sd-wan_firmware | 18.4.1 | |
| cisco | sd-wan_firmware | 18.4.4 | |
| cisco | sd-wan_firmware | 18.4.5 | |
| cisco | sd-wan_firmware | 19.2.0 | |
| cisco | sd-wan_firmware | 19.2.1 | |
| cisco | sd-wan_firmware | 19.2.2 | |
| cisco | sd-wan_firmware | 19.2.99 | |
| cisco | sd-wan_firmware | 20.1.0 | |
| cisco | sd-wan_vsmart_controller_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xe_sd-wan:-:*:*:*:*:*:*:*",
"matchCriteriaId": "16266B9E-E613-45FA-A02B-51EED8BEFCC9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "30EE0731-351C-4889-8335-3E7E7955A385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4CBD6FD9-84EE-416C-B77D-843D2FAAF1BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0015FD1E-1BCD-40AB-8C21-264AB9F6E123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F4C9F1DA-0527-4442-B0B4-4467960D30C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0717AEB4-93B0-47F5-9F1B-153A519AD2E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0065B109-5020-48AE-B10F-3452444748C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9C535AB3-DCCE-4CFB-8479-08550552E863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "07C2CBB8-7296-4549-B98C-D39FA1D35E6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.99:*:*:*:*:*:*:*",
"matchCriteriaId": "B74606C6-B292-4D23-8652-5CF49BDD8369",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:20.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF9C5E2-1A91-43A0-8F51-05A2E204BF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": "Varias vulnerabilidades en los productos Cisco SD-WAN, podr\u00edan permitir a un atacante remoto no autenticado ejecutar ataques de denegaci\u00f3n de servicio (DoS) contra un dispositivo afectado. Para obtener m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
}
],
"id": "CVE-2021-1241",
"lastModified": "2024-11-21T05:43:54.397",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T21:15:12.100",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "ykramarz@cisco.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 20:15
Modified
2024-11-21 05:43
Severity ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "31234E6E-6B7F-4B47-9A77-4264C8356C43",
"versionEndExcluding": "19.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7E8DDF91-1646-49EE-A536-2F7AE5AD88A4",
"versionEndExcluding": "20.1.2",
"versionStartIncluding": "19.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "34133B76-199A-4E35-838B-E533137B7990",
"versionEndExcluding": "20.3.2",
"versionStartIncluding": "20.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:20.4:*:*:*:*:*:*:*",
"matchCriteriaId": "53C982CE-0B5B-4A3E-BCBF-FE64BC899DFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": ""
}
],
"id": "CVE-2021-1262",
"lastModified": "2024-11-21T05:43:57.260",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2,
"source": "ykramarz@cisco.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T20:15:14.970",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 20:15
Modified
2024-11-21 05:44
Severity ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | sd-wan_firmware | 18.2.0 | |
| cisco | sd-wan_firmware | 18.3.0 | |
| cisco | sd-wan_firmware | 18.3.8 | |
| cisco | sd-wan_firmware | 18.4.6 | |
| cisco | sd-wan_firmware | 19.2.3 | |
| cisco | sd-wan_firmware | 19.2.99 | |
| cisco | sd-wan_firmware | 20.1.0 | |
| cisco | sd-wan_vsmart_controller_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AF0E7F2D-6999-4FCD-A922-B57070FD9BCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B2C163B3-5B5D-4216-91FC-42757E3A680D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4CBD6FD9-84EE-416C-B77D-843D2FAAF1BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A04E45E9-9905-4FBC-B632-5EF429F6FC52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "478B7BB3-6358-46F6-8F59-786BA8D2AF5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.99:*:*:*:*:*:*:*",
"matchCriteriaId": "B74606C6-B292-4D23-8652-5CF49BDD8369",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:20.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF9C5E2-1A91-43A0-8F51-05A2E204BF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en los productos Cisco SD-WAN, podr\u00edan permitir a un atacante autenticado conducir ataques de inyecci\u00f3n de comandos contra un dispositivo afectado, lo que podr\u00eda permitirle al atacante tomar determinadas acciones con privilegios root en el dispositivo. Para m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
}
],
"id": "CVE-2021-1298",
"lastModified": "2024-11-21T05:44:02.117",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2,
"source": "ykramarz@cisco.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T20:15:16.643",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-01-20 20:15
Modified
2024-11-21 05:43
Severity ?
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | ios_xe_sd-wan | - | |
| cisco | sd-wan_firmware | 18.3.5 | |
| cisco | sd-wan_firmware | 18.3.8 | |
| cisco | sd-wan_firmware | 18.4.1 | |
| cisco | sd-wan_firmware | 18.4.4 | |
| cisco | sd-wan_firmware | 18.4.5 | |
| cisco | sd-wan_firmware | 19.2.0 | |
| cisco | sd-wan_firmware | 19.2.1 | |
| cisco | sd-wan_firmware | 19.2.2 | |
| cisco | sd-wan_firmware | 19.2.99 | |
| cisco | sd-wan_firmware | 20.1.0 | |
| cisco | sd-wan_vsmart_controller_firmware | * | |
| cisco | vedge_100_router | - | |
| cisco | vedge_1000_router | - | |
| cisco | vedge_100b_router | - | |
| cisco | vedge_100m_router | - | |
| cisco | vedge_100wm_router | - | |
| cisco | vedge_2000_router | - | |
| cisco | vedge_5000_router | - | |
| cisco | vedge_cloud_router | - | |
| cisco | catalyst_sd-wan_manager | - | |
| cisco | sd-wan_vbond_orchestrator | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xe_sd-wan:-:*:*:*:*:*:*:*",
"matchCriteriaId": "16266B9E-E613-45FA-A02B-51EED8BEFCC9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "30EE0731-351C-4889-8335-3E7E7955A385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4CBD6FD9-84EE-416C-B77D-843D2FAAF1BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0015FD1E-1BCD-40AB-8C21-264AB9F6E123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F4C9F1DA-0527-4442-B0B4-4467960D30C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:18.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0717AEB4-93B0-47F5-9F1B-153A519AD2E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0065B109-5020-48AE-B10F-3452444748C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9C535AB3-DCCE-4CFB-8479-08550552E863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "07C2CBB8-7296-4549-B98C-D39FA1D35E6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:19.2.99:*:*:*:*:*:*:*",
"matchCriteriaId": "B74606C6-B292-4D23-8652-5CF49BDD8369",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_firmware:20.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF9C5E2-1A91-43A0-8F51-05A2E204BF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFBC49D2-5618-416A-AE3C-6421B8B09C80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AEE108-5CF9-4F19-9A52-40850F850E91",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7AF418B-E5C4-4FEA-A9B9-9D29002702CE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8282DC4-099F-4379-8B2A-7B876AE29779",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9952ECE-2659-4CAC-B29C-6439391FADDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAF9E5F-C858-44C8-9F81-0916324CF513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA0F3A1-3442-4491-95D6-F5B17A09DB73",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7E1CFE1-8CF7-48BE-833F-03F72B3BAFAB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3773F59-DF2E-4387-8E27-C08FE1E6549D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE3D96F7-3574-443F-9AD4-5E62E0F5E4F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05AFD69C-BB2C-43E0-89CF-FDA00B8F4CB5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en los productos Cisco SD-WAN, podr\u00edan permitir a un atacante no autenticado remoto ejecutar ataques de denegaci\u00f3n de servicio (DoS) contra un dispositivo afectado. Para m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
}
],
"id": "CVE-2021-1274",
"lastModified": "2024-11-21T05:43:58.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-20T20:15:15.970",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2021-1514
Vulnerability from cvelistv5
Published
2021-05-06 12:50
Modified
2024-11-08 23:16
Severity ?
EPSS score ?
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Administrator privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated as a low-privileged user to execute the affected commands. A successful exploit could allow the attacker to execute commands with Administrator privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-QVszVUPy | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:11:17.749Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210505 Cisco SD-WAN Software Privilege Escalation Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-QVszVUPy"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1514",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:43:46.352944Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-08T23:16:58.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-05-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Administrator privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated as a low-privileged user to execute the affected commands. A successful exploit could allow the attacker to execute commands with Administrator privileges."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-06T12:50:58",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210505 Cisco SD-WAN Software Privilege Escalation Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-QVszVUPy"
}
],
"source": {
"advisory": "cisco-sa-sdwan-privesc-QVszVUPy",
"defect": [
[
"CSCvi69989"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Software Privilege Escalation Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-05-05T16:00:00",
"ID": "CVE-2021-1514",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Software Privilege Escalation Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Administrator privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated as a low-privileged user to execute the affected commands. A successful exploit could allow the attacker to execute commands with Administrator privileges."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "4.4",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210505 Cisco SD-WAN Software Privilege Escalation Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-QVszVUPy"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-privesc-QVszVUPy",
"defect": [
[
"CSCvi69989"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1514",
"datePublished": "2021-05-06T12:50:58.964834Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-08T23:16:58.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1546
Vulnerability from cvelistv5
Published
2021-09-23 02:30
Modified
2024-11-07 21:52
Severity ?
EPSS score ?
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to improper protections on file access through the CLI. An attacker could exploit this vulnerability by running a CLI command that targets an arbitrary file on the local system. A successful exploit could allow the attacker to return portions of an arbitrary file, possibly resulting in the disclosure of sensitive information.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-Fhqh8pKX | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:11:17.658Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210922 Cisco SD-WAN Software Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-Fhqh8pKX"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1546",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-07T21:40:31.262640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-07T21:52:24.763Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-09-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to improper protections on file access through the CLI. An attacker could exploit this vulnerability by running a CLI command that targets an arbitrary file on the local system. A successful exploit could allow the attacker to return portions of an arbitrary file, possibly resulting in the disclosure of sensitive information."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-23T02:30:18",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210922 Cisco SD-WAN Software Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-Fhqh8pKX"
}
],
"source": {
"advisory": "cisco-sa-sd-wan-Fhqh8pKX",
"defect": [
[
"CSCvx79335"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Software Information Disclosure Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-09-22T16:00:00",
"ID": "CVE-2021-1546",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Software Information Disclosure Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to improper protections on file access through the CLI. An attacker could exploit this vulnerability by running a CLI command that targets an arbitrary file on the local system. A successful exploit could allow the attacker to return portions of an arbitrary file, possibly resulting in the disclosure of sensitive information."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "5.5",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-209"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210922 Cisco SD-WAN Software Information Disclosure Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-Fhqh8pKX"
}
]
},
"source": {
"advisory": "cisco-sa-sd-wan-Fhqh8pKX",
"defect": [
[
"CSCvx79335"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1546",
"datePublished": "2021-09-23T02:30:18.696150Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-07T21:52:24.763Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1278
Vulnerability from cvelistv5
Published
2021-01-20 19:56
Modified
2024-11-12 20:25
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.383Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1278",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:05:59.298624Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:25:12.150Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T19:56:27",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"source": {
"advisory": "cisco-sa-sdwan-dosmulti-48jJuEUP",
"defect": [
[
"CSCvq20708",
"CSCvt11522",
"CSCvt11523",
"CSCvt11530",
"CSCvu28409",
"CSCvu31763"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Denial of Service Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1278",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Denial of Service Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "8.6",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-dosmulti-48jJuEUP",
"defect": [
[
"CSCvq20708",
"CSCvt11522",
"CSCvt11523",
"CSCvt11530",
"CSCvu28409",
"CSCvu31763"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1278",
"datePublished": "2021-01-20T19:56:27.964347Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:25:12.150Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1262
Vulnerability from cvelistv5
Published
2021-01-20 19:57
Modified
2024-09-16 16:52
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.415Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T19:57:36",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"source": {
"advisory": "cisco-sa-sdwan-cmdinjm-9QMSmgcn",
"defect": [
[
"CSCvi59635",
"CSCvi59639",
"CSCvi69982",
"CSCvm26011",
"CSCvu28387",
"CSCvu28443"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Command Injection Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1262",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Command Injection Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "9.9",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-cmdinjm-9QMSmgcn",
"defect": [
[
"CSCvi59635",
"CSCvi59639",
"CSCvi69982",
"CSCvm26011",
"CSCvu28387",
"CSCvu28443"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1262",
"datePublished": "2021-01-20T19:57:36.628371Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-09-16T16:52:48.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1273
Vulnerability from cvelistv5
Published
2021-01-20 19:56
Modified
2024-11-12 20:24
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.504Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1273",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:05:33.751010Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:24:09.004Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T19:56:57",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"source": {
"advisory": "cisco-sa-sdwan-dosmulti-48jJuEUP",
"defect": [
[
"CSCvq20708",
"CSCvt11522",
"CSCvt11523",
"CSCvt11530",
"CSCvu28409",
"CSCvu31763"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Denial of Service Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1273",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Denial of Service Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "8.6",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-dosmulti-48jJuEUP",
"defect": [
[
"CSCvq20708",
"CSCvt11522",
"CSCvt11523",
"CSCvt11530",
"CSCvu28409",
"CSCvu31763"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1273",
"datePublished": "2021-01-20T19:56:57.444443Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:24:09.004Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-20930
Vulnerability from cvelistv5
Published
2022-09-30 18:46
Modified
2024-11-01 18:50
Severity ?
EPSS score ?
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite and possibly corrupt files on an affected system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary commands that are executed as the root user account. A successful exploit could allow the attacker to overwrite arbitrary system files, which could result in a denial of service (DoS) condition.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-cli-xkGwmqKu | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN vManage |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:31:57.960Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20220928 Cisco SD-WAN Software Arbitrary File Corruption Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-cli-xkGwmqKu"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20930",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-01T18:42:16.371547Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-01T18:50:04.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN vManage",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2022-09-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite and possibly corrupt files on an affected system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary commands that are executed as the root user account. A successful exploit could allow the attacker to overwrite arbitrary system files, which could result in a denial of service (DoS) condition."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-30T18:46:47",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20220928 Cisco SD-WAN Software Arbitrary File Corruption Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-cli-xkGwmqKu"
}
],
"source": {
"advisory": "cisco-sa-sdwan-privesc-cli-xkGwmqKu",
"defect": [
[
"CSCvz46392"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Software Arbitrary File Corruption Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2022-09-28T23:00:00",
"ID": "CVE-2022-20930",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Software Arbitrary File Corruption Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN vManage",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite and possibly corrupt files on an affected system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary commands that are executed as the root user account. A successful exploit could allow the attacker to overwrite arbitrary system files, which could result in a denial of service (DoS) condition."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "6.7",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-88"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20220928 Cisco SD-WAN Software Arbitrary File Corruption Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-cli-xkGwmqKu"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-privesc-cli-xkGwmqKu",
"defect": [
[
"CSCvz46392"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20930",
"datePublished": "2022-09-30T18:46:47.422178Z",
"dateReserved": "2021-11-02T00:00:00",
"dateUpdated": "2024-11-01T18:50:04.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1260
Vulnerability from cvelistv5
Published
2021-01-20 19:57
Modified
2024-11-12 20:22
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.372Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1260",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:26:07.748880Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:22:39.794Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T19:57:45",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"source": {
"advisory": "cisco-sa-sdwan-cmdinjm-9QMSmgcn",
"defect": [
[
"CSCvi59635",
"CSCvi59639",
"CSCvi69982",
"CSCvm26011",
"CSCvu28387",
"CSCvu28443"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Command Injection Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1260",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Command Injection Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "9.9",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-cmdinjm-9QMSmgcn",
"defect": [
[
"CSCvi59635",
"CSCvi59639",
"CSCvi69982",
"CSCvm26011",
"CSCvu28387",
"CSCvu28443"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1260",
"datePublished": "2021-01-20T19:57:46.060378Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:22:39.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1298
Vulnerability from cvelistv5
Published
2021-01-20 19:55
Modified
2024-11-12 20:26
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.476Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1298",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:26:36.546886Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:26:54.826Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T19:55:55",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"source": {
"advisory": "cisco-sa-sdwan-cmdinjm-9QMSmgcn",
"defect": [
[
"CSCvi59635",
"CSCvi59639",
"CSCvi69982",
"CSCvm26011",
"CSCvu28387",
"CSCvu28443"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Command Injection Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1298",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Command Injection Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "9.9",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-cmdinjm-9QMSmgcn",
"defect": [
[
"CSCvi59635",
"CSCvi59639",
"CSCvi69982",
"CSCvm26011",
"CSCvu28387",
"CSCvu28443"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1298",
"datePublished": "2021-01-20T19:55:55.366862Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:26:54.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1300
Vulnerability from cvelistv5
Published
2021-01-20 19:55
Modified
2024-11-12 20:27
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.505Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Buffer Overflow Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1300",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T19:57:03.730870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:27:23.780Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T19:55:45",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Buffer Overflow Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj"
}
],
"source": {
"advisory": "cisco-sa-sdwan-bufovulns-B5NrSHbj",
"defect": [
[
"CSCvi69895",
"CSCvt11525"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Buffer Overflow Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1300",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Buffer Overflow Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "9.8",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Buffer Overflow Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-bufovulns-B5NrSHbj",
"defect": [
[
"CSCvi69895",
"CSCvt11525"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1300",
"datePublished": "2021-01-20T19:55:45.731205Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:27:23.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1305
Vulnerability from cvelistv5
Published
2021-01-20 20:01
Modified
2024-11-12 20:20
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system, gain access to sensitive information, and view information that they are not authorized to access. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-abyp-TnGFHrS | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN vManage |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.385Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN vManage Authorization Bypass Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-abyp-TnGFHrS"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1305",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:26:04.722556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:20:50.977Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN vManage",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system, gain access to sensitive information, and view information that they are not authorized to access. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T20:01:06",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN vManage Authorization Bypass Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-abyp-TnGFHrS"
}
],
"source": {
"advisory": "cisco-sa-sdwan-abyp-TnGFHrS",
"defect": [
[
"CSCvi59734",
"CSCvs11283",
"CSCvu28377"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN vManage Authorization Bypass Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1305",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN vManage Authorization Bypass Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN vManage",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system, gain access to sensitive information, and view information that they are not authorized to access. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "8.8",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN vManage Authorization Bypass Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-abyp-TnGFHrS"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-abyp-TnGFHrS",
"defect": [
[
"CSCvi59734",
"CSCvs11283",
"CSCvu28377"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1305",
"datePublished": "2021-01-20T20:01:06.865098Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:20:50.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1512
Vulnerability from cvelistv5
Published
2021-05-06 12:42
Modified
2024-11-08 23:18
Severity ?
EPSS score ?
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system of an affected system. This vulnerability is due to insufficient validation of the user-supplied input parameters of a specific CLI command. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content in any arbitrary files that reside on the underlying host file system.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfile-7Qhd9mCn | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:11:17.770Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210505 Cisco SD-WAN Software Arbitrary File Corruption Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfile-7Qhd9mCn"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1512",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:44:02.972032Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-08T23:18:51.250Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-05-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system of an affected system. This vulnerability is due to insufficient validation of the user-supplied input parameters of a specific CLI command. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content in any arbitrary files that reside on the underlying host file system."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-552",
"description": "CWE-552",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-06T12:42:11",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210505 Cisco SD-WAN Software Arbitrary File Corruption Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfile-7Qhd9mCn"
}
],
"source": {
"advisory": "cisco-sa-sdwan-arbfile-7Qhd9mCn",
"defect": [
[
"CSCvs98457"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Software Arbitrary File Corruption Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-05-05T16:00:00",
"ID": "CVE-2021-1512",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Software Arbitrary File Corruption Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system of an affected system. This vulnerability is due to insufficient validation of the user-supplied input parameters of a specific CLI command. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content in any arbitrary files that reside on the underlying host file system."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "4.4",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-552"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210505 Cisco SD-WAN Software Arbitrary File Corruption Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfile-7Qhd9mCn"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-arbfile-7Qhd9mCn",
"defect": [
[
"CSCvs98457"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1512",
"datePublished": "2021-05-06T12:42:11.741571Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-08T23:18:51.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1279
Vulnerability from cvelistv5
Published
2021-01-20 19:56
Modified
2024-11-12 20:25
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.390Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1279",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:06:05.270168Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:25:21.910Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T19:56:23",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"source": {
"advisory": "cisco-sa-sdwan-dosmulti-48jJuEUP",
"defect": [
[
"CSCvq20708",
"CSCvt11522",
"CSCvt11523",
"CSCvt11530",
"CSCvu28409",
"CSCvu31763"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Denial of Service Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1279",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Denial of Service Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "8.6",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-dosmulti-48jJuEUP",
"defect": [
[
"CSCvq20708",
"CSCvt11522",
"CSCvt11523",
"CSCvt11530",
"CSCvu28409",
"CSCvu31763"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1279",
"datePublished": "2021-01-20T19:56:23.484524Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:25:21.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1528
Vulnerability from cvelistv5
Published
2021-06-04 16:45
Modified
2024-11-07 22:09
Severity ?
EPSS score ?
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulnerability exists because the affected software does not properly restrict access to privileged processes. An attacker could exploit this vulnerability by invoking a privileged process in the affected system. A successful exploit could allow the attacker to perform actions with the privileges of the root user.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-fuErCWwF | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:11:17.699Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210602 Cisco SD-WAN Software Privilege Escalation Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-fuErCWwF"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1528",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-07T21:43:49.366641Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-07T22:09:53.223Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-06-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulnerability exists because the affected software does not properly restrict access to privileged processes. An attacker could exploit this vulnerability by invoking a privileged process in the affected system. A successful exploit could allow the attacker to perform actions with the privileges of the root user."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-04T16:45:40",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210602 Cisco SD-WAN Software Privilege Escalation Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-fuErCWwF"
}
],
"source": {
"advisory": "cisco-sa-sd-wan-fuErCWwF",
"defect": [
[
"CSCvx49259"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Software Privilege Escalation Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-06-02T16:00:00",
"ID": "CVE-2021-1528",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Software Privilege Escalation Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulnerability exists because the affected software does not properly restrict access to privileged processes. An attacker could exploit this vulnerability by invoking a privileged process in the affected system. A successful exploit could allow the attacker to perform actions with the privileges of the root user."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "7.8",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-250"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210602 Cisco SD-WAN Software Privilege Escalation Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-fuErCWwF"
}
]
},
"source": {
"advisory": "cisco-sa-sd-wan-fuErCWwF",
"defect": [
[
"CSCvx49259"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1528",
"datePublished": "2021-06-04T16:45:40.937983Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-07T22:09:53.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1233
Vulnerability from cvelistv5
Published
2021-01-20 20:10
Modified
2024-11-12 20:20
Severity ?
EPSS score ?
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information on an affected device. The vulnerability is due to insufficient input validation of requests that are sent to the iperf tool. An attacker could exploit this vulnerability by sending a crafted request to the iperf tool, which is included in Cisco SD-WAN Software. A successful exploit could allow the attacker to obtain any file from the filesystem of an affected device.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-infodis-2-UPO232DG | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.214Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-infodis-2-UPO232DG"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1233",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:50:39.644744Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:20:35.284Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information on an affected device. The vulnerability is due to insufficient input validation of requests that are sent to the iperf tool. An attacker could exploit this vulnerability by sending a crafted request to the iperf tool, which is included in Cisco SD-WAN Software. A successful exploit could allow the attacker to obtain any file from the filesystem of an affected device."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T20:10:37",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-infodis-2-UPO232DG"
}
],
"source": {
"advisory": "cisco-sa-sdwan-infodis-2-UPO232DG",
"defect": [
[
"CSCvi69962"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Information Disclosure Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1233",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Information Disclosure Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information on an affected device. The vulnerability is due to insufficient input validation of requests that are sent to the iperf tool. An attacker could exploit this vulnerability by sending a crafted request to the iperf tool, which is included in Cisco SD-WAN Software. A successful exploit could allow the attacker to obtain any file from the filesystem of an affected device."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "4.4",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Information Disclosure Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-infodis-2-UPO232DG"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-infodis-2-UPO232DG",
"defect": [
[
"CSCvi69962"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1233",
"datePublished": "2021-01-20T20:10:37.217748Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:20:35.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1301
Vulnerability from cvelistv5
Published
2021-01-20 19:55
Modified
2024-11-12 20:27
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.446Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Buffer Overflow Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1301",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T19:57:06.857061Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:27:38.208Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T19:55:40",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Buffer Overflow Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj"
}
],
"source": {
"advisory": "cisco-sa-sdwan-bufovulns-B5NrSHbj",
"defect": [
[
"CSCvi69895",
"CSCvt11525"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Buffer Overflow Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1301",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Buffer Overflow Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "9.8",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Buffer Overflow Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-bufovulns-B5NrSHbj",
"defect": [
[
"CSCvi69895",
"CSCvt11525"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1301",
"datePublished": "2021-01-20T19:55:40.540418Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:27:38.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1241
Vulnerability from cvelistv5
Published
2021-01-20 20:10
Modified
2024-11-12 20:20
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.326Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1241",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:04:52.924039Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:20:20.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T20:10:48",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"source": {
"advisory": "cisco-sa-sdwan-dosmulti-48jJuEUP",
"defect": [
[
"CSCvq20708",
"CSCvt11522",
"CSCvt11523",
"CSCvt11530",
"CSCvu28409",
"CSCvu31763"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Denial of Service Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1241",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Denial of Service Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "8.6",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-dosmulti-48jJuEUP",
"defect": [
[
"CSCvq20708",
"CSCvt11522",
"CSCvt11523",
"CSCvt11530",
"CSCvu28409",
"CSCvu31763"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1241",
"datePublished": "2021-01-20T20:10:49.084947Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:20:20.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-20818
Vulnerability from cvelistv5
Published
2022-09-30 18:45
Modified
2024-11-01 18:51
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:24:49.956Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20220928 Cisco SD-WAN Software Privilege Escalation Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20818",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-01T18:42:18.470570Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-01T18:51:20.116Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2022-09-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-25",
"description": "CWE-25",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-30T18:45:36",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20220928 Cisco SD-WAN Software Privilege Escalation Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"
}
],
"source": {
"advisory": "cisco-sa-sd-wan-priv-E6e8tEdF",
"defect": [
[
"CSCwa52793",
"CSCwb54198"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Software Privilege Escalation Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2022-09-28T16:00:00",
"ID": "CVE-2022-20818",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Software Privilege Escalation Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "7.8",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-25"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20220928 Cisco SD-WAN Software Privilege Escalation Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"
}
]
},
"source": {
"advisory": "cisco-sa-sd-wan-priv-E6e8tEdF",
"defect": [
[
"CSCwa52793",
"CSCwb54198"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20818",
"datePublished": "2022-09-30T18:45:36.170921Z",
"dateReserved": "2021-11-02T00:00:00",
"dateUpdated": "2024-11-01T18:51:20.116Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1513
Vulnerability from cvelistv5
Published
2021-05-06 12:50
Modified
2024-11-08 23:17
Severity ?
EPSS score ?
Summary
A vulnerability in the vDaemon process of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient handling of malformed packets. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dos-Ckn5cVqW | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:11:17.692Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210505 Cisco SD-WAN Software vDaemon Denial of Service Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dos-Ckn5cVqW"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1513",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:01:28.542164Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-08T23:17:08.141Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-05-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the vDaemon process of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient handling of malformed packets. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-06T12:50:54",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210505 Cisco SD-WAN Software vDaemon Denial of Service Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dos-Ckn5cVqW"
}
],
"source": {
"advisory": "cisco-sa-sdwan-dos-Ckn5cVqW",
"defect": [
[
"CSCvu28378"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Software vDaemon Denial of Service Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-05-05T16:00:00",
"ID": "CVE-2021-1513",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Software vDaemon Denial of Service Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the vDaemon process of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient handling of malformed packets. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "7.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210505 Cisco SD-WAN Software vDaemon Denial of Service Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dos-Ckn5cVqW"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-dos-Ckn5cVqW",
"defect": [
[
"CSCvu28378"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1513",
"datePublished": "2021-05-06T12:50:54.548142Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-08T23:17:08.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1261
Vulnerability from cvelistv5
Published
2021-01-20 19:57
Modified
2024-11-12 20:22
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.285Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1261",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:26:09.378444Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:22:58.597Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T19:57:41",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"source": {
"advisory": "cisco-sa-sdwan-cmdinjm-9QMSmgcn",
"defect": [
[
"CSCvi59635",
"CSCvi59639",
"CSCvi69982",
"CSCvm26011",
"CSCvu28387",
"CSCvu28443"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Command Injection Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1261",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Command Injection Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "9.9",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-cmdinjm-9QMSmgcn",
"defect": [
[
"CSCvi59635",
"CSCvi59639",
"CSCvi69982",
"CSCvm26011",
"CSCvu28387",
"CSCvu28443"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1261",
"datePublished": "2021-01-20T19:57:41.546046Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:22:58.597Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1274
Vulnerability from cvelistv5
Published
2021-01-20 19:56
Modified
2024-11-12 20:24
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.378Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1274",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:05:40.920927Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:24:31.551Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T19:56:47",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
],
"source": {
"advisory": "cisco-sa-sdwan-dosmulti-48jJuEUP",
"defect": [
[
"CSCvq20708",
"CSCvt11522",
"CSCvt11523",
"CSCvt11530",
"CSCvu28409",
"CSCvu31763"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Denial of Service Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1274",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Denial of Service Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "8.6",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Denial of Service Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-dosmulti-48jJuEUP",
"defect": [
[
"CSCvq20708",
"CSCvt11522",
"CSCvt11523",
"CSCvt11530",
"CSCvu28409",
"CSCvu31763"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1274",
"datePublished": "2021-01-20T19:56:47.754679Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:24:31.551Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-20716
Vulnerability from cvelistv5
Published
2022-04-15 14:15
Modified
2024-11-06 16:27
Severity ?
EPSS score ?
Summary
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper access control on files within the affected system. A local attacker could exploit this vulnerability by modifying certain files on the vulnerable device. If successful, the attacker could gain escalated privileges and take actions on the system with the privileges of the root user.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-file-access-VW36d28P | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:24:48.570Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20220413 Cisco SD-WAN Solution Improper Access Control Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-file-access-VW36d28P"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20716",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-06T16:00:14.940408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T16:27:22.568Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2022-04-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper access control on files within the affected system. A local attacker could exploit this vulnerability by modifying certain files on the vulnerable device. If successful, the attacker could gain escalated privileges and take actions on the system with the privileges of the root user."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-15T14:15:34",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20220413 Cisco SD-WAN Solution Improper Access Control Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-file-access-VW36d28P"
}
],
"source": {
"advisory": "cisco-sa-sd-wan-file-access-VW36d28P",
"defect": [
[
"CSCvy11382"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Solution Improper Access Control Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2022-04-13T23:00:00",
"ID": "CVE-2022-20716",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Solution Improper Access Control Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper access control on files within the affected system. A local attacker could exploit this vulnerability by modifying certain files on the vulnerable device. If successful, the attacker could gain escalated privileges and take actions on the system with the privileges of the root user."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "7.8",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20220413 Cisco SD-WAN Solution Improper Access Control Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-file-access-VW36d28P"
}
]
},
"source": {
"advisory": "cisco-sa-sd-wan-file-access-VW36d28P",
"defect": [
[
"CSCvy11382"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20716",
"datePublished": "2022-04-15T14:15:34.260733Z",
"dateReserved": "2021-11-02T00:00:00",
"dateUpdated": "2024-11-06T16:27:22.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-20850
Vulnerability from cvelistv5
Published
2022-09-30 18:46
Modified
2024-11-01 18:50
Severity ?
EPSS score ?
Summary
A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitrary files from the file system of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary file path information when using commands in the CLI of an affected device. A successful exploit could allow the attacker to delete arbitrary files from the file system of the affected device.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-arb-file-delete-VB2rVcQv | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:24:50.267Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20220928 Cisco SD-WAN Arbitrary File Deletion Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-arb-file-delete-VB2rVcQv"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20850",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-01T18:40:31.320155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-01T18:50:42.028Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2022-09-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitrary files from the file system of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary file path information when using commands in the CLI of an affected device. A successful exploit could allow the attacker to delete arbitrary files from the file system of the affected device."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-30T18:46:05",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20220928 Cisco SD-WAN Arbitrary File Deletion Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-arb-file-delete-VB2rVcQv"
}
],
"source": {
"advisory": "cisco-sa-arb-file-delete-VB2rVcQv",
"defect": [
[
"CSCvm25943"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Arbitrary File Deletion Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2022-09-28T16:00:00",
"ID": "CVE-2022-20850",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Arbitrary File Deletion Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitrary files from the file system of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary file path information when using commands in the CLI of an affected device. A successful exploit could allow the attacker to delete arbitrary files from the file system of the affected device."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "5.5",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20220928 Cisco SD-WAN Arbitrary File Deletion Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-arb-file-delete-VB2rVcQv"
}
]
},
"source": {
"advisory": "cisco-sa-arb-file-delete-VB2rVcQv",
"defect": [
[
"CSCvm25943"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20850",
"datePublished": "2022-09-30T18:46:05.246074Z",
"dateReserved": "2021-11-02T00:00:00",
"dateUpdated": "2024-11-01T18:50:42.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-20775
Vulnerability from cvelistv5
Published
2022-09-30 18:45
Modified
2024-11-06 16:04
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:24:49.634Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20220928 Cisco SD-WAN Software Privilege Escalation Vulnerabilities",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"
},
{
"tags": [
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20775",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-06T15:59:59.012148Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T16:04:36.905Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2022-09-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-25",
"description": "CWE-25",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-11T00:00:00",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20220928 Cisco SD-WAN Software Privilege Escalation Vulnerabilities",
"tags": [
"vendor-advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"
},
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"
},
{
"url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc"
}
],
"source": {
"advisory": "cisco-sa-sd-wan-priv-E6e8tEdF",
"defect": [
[
"CSCwa52793",
"CSCwb54198"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Software Privilege Escalation Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20775",
"datePublished": "2022-09-30T18:45:26.687373Z",
"dateReserved": "2021-11-02T00:00:00",
"dateUpdated": "2024-11-06T16:04:36.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1299
Vulnerability from cvelistv5
Published
2021-01-20 19:55
Modified
2024-11-12 20:27
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.477Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1299",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:26:47.622875Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:27:08.904Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T19:55:50",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"source": {
"advisory": "cisco-sa-sdwan-cmdinjm-9QMSmgcn",
"defect": [
[
"CSCvi59635",
"CSCvi59639",
"CSCvi69982",
"CSCvm26011",
"CSCvu28387",
"CSCvu28443"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Command Injection Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1299",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Command Injection Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "9.9",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-cmdinjm-9QMSmgcn",
"defect": [
[
"CSCvi59635",
"CSCvi59639",
"CSCvi69982",
"CSCvm26011",
"CSCvu28387",
"CSCvu28443"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1299",
"datePublished": "2021-01-20T19:55:50.579107Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:27:08.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-1263
Vulnerability from cvelistv5
Published
2021-01-20 19:57
Modified
2024-11-12 20:23
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco SD-WAN Solution |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:02:56.396Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-1263",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:26:15.321605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T20:23:05.931Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco SD-WAN Solution",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T19:57:31",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
],
"source": {
"advisory": "cisco-sa-sdwan-cmdinjm-9QMSmgcn",
"defect": [
[
"CSCvi59635",
"CSCvi59639",
"CSCvi69982",
"CSCvm26011",
"CSCvu28387",
"CSCvu28443"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco SD-WAN Command Injection Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-01-20T16:00:00",
"ID": "CVE-2021-1263",
"STATE": "PUBLIC",
"TITLE": "Cisco SD-WAN Command Injection Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco SD-WAN Solution",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "9.9",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210120 Cisco SD-WAN Command Injection Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"
}
]
},
"source": {
"advisory": "cisco-sa-sdwan-cmdinjm-9QMSmgcn",
"defect": [
[
"CSCvi59635",
"CSCvi59639",
"CSCvi69982",
"CSCvm26011",
"CSCvu28387",
"CSCvu28443"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-1263",
"datePublished": "2021-01-20T19:57:31.925676Z",
"dateReserved": "2020-11-13T00:00:00",
"dateUpdated": "2024-11-12T20:23:05.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}