CVE-2021-1584CWE-78

Cisco Nexus 9000 Series Fabric Switches ACI Mode Privilege Escalation Vulnerability

Medium · published August 25, 2021

CVSS v3.1
6.0
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient restrictions during the execution of a specific CLI command. An attacker with administrative privileges could exploit this vulnerability by performing a command injection attack on the vulnerable command. A successful exploit could allow the attacker to access the underlying operating system as root.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00446 · 37.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2021-08-25T19:10Z
EPSS history
Timeline
  • 25 AUG 19:10Z
    Cisco Nexus 9000 Series Fabric Switches ACI Mode Privilege Escalation Vulnerability
    cvelistv5