CVE-2021-1435CWE-22

Cisco IOS XE Software Web UI Command Injection Vulnerability

Medium · published March 24, 2021

CVSS v3.0
6.6
EPSS
9%
Percentile
95.1
In the wild
Unconfirmed
What it is

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the root user. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to the web UI of an affected device with arbitrary commands injected into a portion of the request. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

The record
Technical detail
CVSS v3.0
6.6 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.08544 · 95.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2021-03-24T20:05Z
EPSS history
Timeline
  • 24 MAR 20:05Z
    Cisco IOS XE Software Web UI Command Injection Vulnerability
    cvelistv5