var-202103-0468
Vulnerability from variot
A vulnerability in CLI management in Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system as the root user. This vulnerability is due to the way the software handles concurrent CLI sessions. An attacker could exploit this vulnerability by authenticating to the device as an administrative user and executing a sequence of commands. A successful exploit could allow the attacker to obtain access to the underlying operating system as the root user. Cisco IOS XE SD-WAN Contains a privilege management vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202103-0468", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.1w" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.1.1t" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.1.1" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.2.1" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.1a" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.4.1" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.9.1" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.4.1a" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.10.1f" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.4.1b" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.9.4" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.1.2" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.10.1e" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.2.1r" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.1c" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.9.2" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.1s" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.3.1w" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.1.3" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.10.1" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.1z" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.4" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.3s" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.3.1a" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.1.1a" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.10.1b" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.2a" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.10.1c" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.10.1d" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.10.1s" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.2.1a" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.1x" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.1.1s" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.3" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.4a" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.3.1" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.3.2" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.1t" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.2t" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.10.3" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.11.2" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.2s" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.2" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.10.1a" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.10.2" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.11.1c" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.11.1a" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.1" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.1za" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.2.1v" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.1y" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.10.1g" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.9.3" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.12.3a" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.2.2" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.11.1" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.11.1s" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "16.11.1b" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.3.2a" }, { "model": "cisco ios xe", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba", "version": null }, { "model": "cisco ios xe", "scope": "eq", "trust": 0.8, "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba", "version": null } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2021-004752" }, { "db": "NVD", "id": "CVE-2021-1281" } ] }, "cve": "CVE-2021-1281", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 3.4, "id": "CVE-2021-1281", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "MEDIUM", "trust": 1.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 3.4, "id": "VHN-374335", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:L/AC:M/AU:N/C:C/I:C/A:C", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "LOCAL", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "exploitabilityScore": 0.8, "id": "CVE-2021-1281", "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "LOW", "attackVector": "LOCAL", "author": "ykramarz@cisco.com", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "exploitabilityScore": 0.8, "id": "CVE-2021-1281", "impactScore": 4.2, "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Local", "author": "NVD", "availabilityImpact": "High", "baseScore": 6.7, "baseSeverity": "Medium", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2021-1281", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "High", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2021-1281", "trust": 1.0, "value": "MEDIUM" }, { "author": "ykramarz@cisco.com", "id": "CVE-2021-1281", "trust": 1.0, "value": "MEDIUM" }, { "author": "NVD", "id": "CVE-2021-1281", "trust": 0.8, "value": "Medium" }, { "author": "CNNVD", "id": "CNNVD-202103-1455", "trust": 0.6, "value": "MEDIUM" }, { "author": "VULHUB", "id": "VHN-374335", "trust": 0.1, "value": "MEDIUM" }, { "author": "VULMON", "id": "CVE-2021-1281", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-374335" }, { "db": "VULMON", "id": "CVE-2021-1281" }, { "db": "JVNDB", "id": "JVNDB-2021-004752" }, { "db": "CNNVD", "id": "CNNVD-202103-1455" }, { "db": "NVD", "id": "CVE-2021-1281" }, { "db": "NVD", "id": "CVE-2021-1281" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A vulnerability in CLI management in Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system as the root user. This vulnerability is due to the way the software handles concurrent CLI sessions. An attacker could exploit this vulnerability by authenticating to the device as an administrative user and executing a sequence of commands. A successful exploit could allow the attacker to obtain access to the underlying operating system as the root user. Cisco IOS XE SD-WAN Contains a privilege management vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state", "sources": [ { "db": "NVD", "id": "CVE-2021-1281" }, { "db": "JVNDB", "id": "JVNDB-2021-004752" }, { "db": "VULHUB", "id": "VHN-374335" }, { "db": "VULMON", "id": "CVE-2021-1281" } ], "trust": 1.8 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2021-1281", "trust": 2.6 }, { "db": "JVNDB", "id": "JVNDB-2021-004752", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-202103-1455", "trust": 0.7 }, { "db": "VULHUB", "id": "VHN-374335", "trust": 0.1 }, { "db": "VULMON", "id": "CVE-2021-1281", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-374335" }, { "db": "VULMON", "id": "CVE-2021-1281" }, { "db": "JVNDB", "id": "JVNDB-2021-004752" }, { "db": "CNNVD", "id": "CNNVD-202103-1455" }, { "db": "NVD", "id": "CVE-2021-1281" } ] }, "id": "VAR-202103-0468", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-374335" } ], "trust": 0.01 }, "last_update_date": "2024-11-23T22:29:18.130000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "cisco-sa-sdwan-clipriv-9TO2QGVp", "trust": 0.8, "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-clipriv-9TO2QGVp" }, { "title": "Cisco IOS XE SD-WAN Software Remediation of resource management error vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=145734" }, { "title": "Cisco: Cisco IOS XE SD-WAN Software Privilege Escalation Vulnerability", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-sdwan-clipriv-9TO2QGVp" } ], "sources": [ { "db": "VULMON", "id": "CVE-2021-1281" }, { "db": "JVNDB", "id": "JVNDB-2021-004752" }, { "db": "CNNVD", "id": "CNNVD-202103-1455" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-399", "trust": 1.0 }, { "problemtype": "NVD-CWE-noinfo", "trust": 1.0 }, { "problemtype": "Improper authority management (CWE-269) [NVD Evaluation ]", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2021-004752" }, { "db": "NVD", "id": "CVE-2021-1281" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.8, "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-sdwan-clipriv-9to2qgvp" }, { "trust": 1.4, "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1281" }, { "trust": 0.6, "url": "https://vigilance.fr/vulnerability/cisco-ios-ios-xe-multiple-vulnerabilities-34940" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/269.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov" }, { "trust": 0.1, "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/198714" } ], "sources": [ { "db": "VULHUB", "id": "VHN-374335" }, { "db": "VULMON", "id": "CVE-2021-1281" }, { "db": "JVNDB", "id": "JVNDB-2021-004752" }, { "db": "CNNVD", "id": "CNNVD-202103-1455" }, { "db": "NVD", "id": "CVE-2021-1281" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-374335" }, { "db": "VULMON", "id": "CVE-2021-1281" }, { "db": "JVNDB", "id": "JVNDB-2021-004752" }, { "db": "CNNVD", "id": "CNNVD-202103-1455" }, { "db": "NVD", "id": "CVE-2021-1281" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2021-03-24T00:00:00", "db": "VULHUB", "id": "VHN-374335" }, { "date": "2021-03-24T00:00:00", "db": "VULMON", "id": "CVE-2021-1281" }, { "date": "2021-11-29T00:00:00", "db": "JVNDB", "id": "JVNDB-2021-004752" }, { "date": "2021-03-24T00:00:00", "db": "CNNVD", "id": "CNNVD-202103-1455" }, { "date": "2021-03-24T21:15:11.443000", "db": "NVD", "id": "CVE-2021-1281" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2022-08-05T00:00:00", "db": "VULHUB", "id": "VHN-374335" }, { "date": "2021-03-29T00:00:00", "db": "VULMON", "id": "CVE-2021-1281" }, { "date": "2021-11-29T09:15:00", "db": "JVNDB", "id": "JVNDB-2021-004752" }, { "date": "2022-08-10T00:00:00", "db": "CNNVD", "id": "CNNVD-202103-1455" }, { "date": "2024-11-21T05:43:59.830000", "db": "NVD", "id": "CVE-2021-1281" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "local", "sources": [ { "db": "CNNVD", "id": "CNNVD-202103-1455" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Cisco\u00a0IOS\u00a0XE\u00a0SD-WAN\u00a0 Vulnerability in privilege management", "sources": [ { "db": "JVNDB", "id": "JVNDB-2021-004752" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "resource management error", "sources": [ { "db": "CNNVD", "id": "CNNVD-202103-1455" } ], "trust": 0.6 } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.