CVE-2021-1612CWE-61

Cisco IOS XE SD-WAN Software Arbitrary File Overwrite Vulnerability

Medium · published September 23, 2021

CVSS v3.1
5.5
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to overwrite arbitrary files on the local system. This vulnerability is due to improper access controls on files within the local file system. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on an affected device.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00250 · 15.4th percentile
Weakness
CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2021-09-23T02:30Z
EPSS history
Timeline
  • 23 SEP 02:30Z
    Cisco IOS XE SD-WAN Software Arbitrary File Overwrite Vulnerability
    cvelistv5