cnvd-2021-50587
Vulnerability from cnvd
Title: Cisco IOS和IOS XE权限提升漏洞
Description:
Cisco IOS是美国Cisco公司为其网络设备开发的操作维护系统,用户通过命令行人机界面对网络设备进行功能设置。 IOS XE是为其网络设备开发的一套基于Linux内核的模块化操作系统。
Cisco IOS和IOS XE的Dragonite调试器存在权限提升漏洞,该漏洞源于设备上保留了开发测试和验证脚本,本地认证攻击者可利用该漏洞将权限从15级提升到root权限。
Severity: 高
Patch Name: Cisco IOS和IOS XE权限提升漏洞的补丁
Patch Description:
Cisco IOS是美国Cisco公司为其网络设备开发的操作维护系统,用户通过命令行人机界面对网络设备进行功能设置。 IOS XE是为其网络设备开发的一套基于Linux内核的模块化操作系统。
Cisco IOS和IOS XE的Dragonite调试器存在权限提升漏洞,该漏洞源于设备上保留了开发测试和验证脚本,本地认证攻击者可利用该漏洞将权限从15级提升到root权限。目前,供应商发布了安全公告及相关补丁信息,修复了此漏洞。
Formal description:
厂商已发布了漏洞修复程序,请及时关注更新: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-FSM-Yj8qJbJc
Reference: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-FSM-Yj8qJbJc
Impacted products
Name | ['Cisco Catalyst IE3300 Rugged Series Switches', 'Cisco Catalyst IE3400 Rugged Series Switches', 'Cisco Catalyst IE3400 Heavy Duty Series Switches', 'Cisco Embedded Services 3300 Series Switches', 'Cisco Catalyst IE3200 Rugged Series Switches'] |
---|
{ "cves": { "cve": { "cveNumber": "CVE-2021-1391", "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-1391" } }, "description": "Cisco IOS\u662f\u7f8e\u56fdCisco\u516c\u53f8\u4e3a\u5176\u7f51\u7edc\u8bbe\u5907\u5f00\u53d1\u7684\u64cd\u4f5c\u7ef4\u62a4\u7cfb\u7edf\uff0c\u7528\u6237\u901a\u8fc7\u547d\u4ee4\u884c\u4eba\u673a\u754c\u9762\u5bf9\u7f51\u7edc\u8bbe\u5907\u8fdb\u884c\u529f\u80fd\u8bbe\u7f6e\u3002 IOS XE\u662f\u4e3a\u5176\u7f51\u7edc\u8bbe\u5907\u5f00\u53d1\u7684\u4e00\u5957\u57fa\u4e8eLinux\u5185\u6838\u7684\u6a21\u5757\u5316\u64cd\u4f5c\u7cfb\u7edf\u3002\n\nCisco IOS\u548cIOS XE\u7684Dragonite\u8c03\u8bd5\u5668\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8bbe\u5907\u4e0a\u4fdd\u7559\u4e86\u5f00\u53d1\u6d4b\u8bd5\u548c\u9a8c\u8bc1\u811a\u672c\uff0c\u672c\u5730\u8ba4\u8bc1\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u6743\u9650\u4ece15\u7ea7\u63d0\u5347\u5230root\u6743\u9650\u3002", "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-FSM-Yj8qJbJc", "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e", "number": "CNVD-2021-50587", "openTime": "2021-07-14", "patchDescription": "Cisco IOS\u662f\u7f8e\u56fdCisco\u516c\u53f8\u4e3a\u5176\u7f51\u7edc\u8bbe\u5907\u5f00\u53d1\u7684\u64cd\u4f5c\u7ef4\u62a4\u7cfb\u7edf\uff0c\u7528\u6237\u901a\u8fc7\u547d\u4ee4\u884c\u4eba\u673a\u754c\u9762\u5bf9\u7f51\u7edc\u8bbe\u5907\u8fdb\u884c\u529f\u80fd\u8bbe\u7f6e\u3002 IOS XE\u662f\u4e3a\u5176\u7f51\u7edc\u8bbe\u5907\u5f00\u53d1\u7684\u4e00\u5957\u57fa\u4e8eLinux\u5185\u6838\u7684\u6a21\u5757\u5316\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nCisco IOS\u548cIOS XE\u7684Dragonite\u8c03\u8bd5\u5668\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8bbe\u5907\u4e0a\u4fdd\u7559\u4e86\u5f00\u53d1\u6d4b\u8bd5\u548c\u9a8c\u8bc1\u811a\u672c\uff0c\u672c\u5730\u8ba4\u8bc1\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u6743\u9650\u4ece15\u7ea7\u63d0\u5347\u5230root\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002", "patchName": "Cisco IOS\u548cIOS XE\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u7684\u8865\u4e01", "products": { "product": [ "Cisco Catalyst IE3300 Rugged Series Switches", "Cisco Catalyst IE3400 Rugged Series Switches", "Cisco Catalyst IE3400 Heavy Duty Series Switches", "Cisco Embedded Services 3300 Series Switches", "Cisco Catalyst IE3200 Rugged Series Switches" ] }, "referenceLink": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-FSM-Yj8qJbJc", "serverity": "\u9ad8", "submitTime": "2021-03-25", "title": "Cisco IOS\u548cIOS XE\u6743\u9650\u63d0\u5347\u6f0f\u6d1e" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…