CVE-2021-1484CWE-88

Cisco SD-WAN vManage Command Injection Vulnerability

Medium · published November 15, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
69.0
In the wild
Unconfirmed
What it is

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to inject arbitrary commands on an affected system and cause a denial of service (DoS) condition.

This vulnerability is due to improper input validation of user-supplied input to the device template configuration. An attacker could exploit this vulnerability by submitting crafted input to the device template configuration. A successful exploit could allow the attacker to cause a DoS condition on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/RL:X/RC:X/E:X
CVSS v4.0
Not supplied
EPSS
0.01243 · 69.0th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2024-11-15T16:26Z
EPSS history
Timeline
  • 15 NOV 16:26Z
    Cisco SD-WAN vManage Command Injection Vulnerability
    cvelistv5