Vulnerability Name: | CVE-2021-1434 (CCN-198701) |
Assigned: | 2020-11-13 |
Published: | 2021-03-24 |
Updated: | 2021-03-29 |
Summary: | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system. This vulnerability is due to insufficient validation of the parameters of a specific CLI command. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content of any arbitrary file that resides on the underlying host file system.
|
CVSS v3 Severity: | 6.0 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) 5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C)Exploitability Metrics: | Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): High User Interaction (UI): None | Scope: | Scope (S): Unchanged
| Impact Metrics: | Confidentiality (C): None Integrity (I): High Availibility (A): High | 4.4 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) 3.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)Exploitability Metrics: | Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): High User Interaction (UI): None | Scope: | Scope (S): Unchanged
| Impact Metrics: | Confidentiality (C): None Integrity (I): High Availibility (A): None |
|
CVSS v2 Severity: | 6.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:C/A:C)Exploitability Metrics: | Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None | Impact Metrics: | Confidentiality (C): None Integrity (I): Complete Availibility (A): Complete | 4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:C/A:N)Exploitability Metrics: | Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
| Impact Metrics: | Confidentiality (C): None Integrity (I): Complete Availibility (A): None |
|
Vulnerability Type: | CWE-552
|
Vulnerability Consequences: | Bypass Security |
References: | Source: MITRE Type: CNA CVE-2021-1434
Source: XF Type: UNKNOWN cisco-cve20211434-sec-bypass(198701)
Source: CCN Type: Cisco Security Advisory cisco-sa-iosxe-arbfile-FUxskKDE Cisco IOS XE SD-WAN Software Arbitrary File Corruption Vulnerability
Source: CISCO Type: Vendor Advisory 20210324 Cisco IOS XE SD-WAN Software Arbitrary File Corruption Vulnerability
|
Vulnerable Configuration: | Configuration 1: cpe:/o:cisco:ios_xe:16.11.1:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.11.1a:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.11.1b:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.11.1c:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.11.1s:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.11.2:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1a:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1c:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1s:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1t:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1w:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1x:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1y:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1z:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1za:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.2:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.2a:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.2s:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.2t:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.3:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.3a:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.3s:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.2.1:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.2.1a:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.2.1r:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.2.1v:*:*:*:*:*:*:* Denotes that component is vulnerable |
BACK |