CVE-2021-1382CWE-77

Cisco IOS XE SD-WAN Software Command Injection Vulnerability

Medium · published March 24, 2021

CVSS v3.1
6.0
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated as an administrative user to execute the affected commands. A successful exploit could allow the attacker to execute commands with root privileges.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00712 · 53.1th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2021-03-24T20:07Z
EPSS history
Timeline
  • 24 MAR 20:07Z
    Cisco IOS XE SD-WAN Software Command Injection Vulnerability
    cvelistv5