CVE-2021-34723CWE-668

Cisco IOS XE SD-WAN Software Arbitrary File Overwrite Vulnerability

Medium · published September 23, 2021

CVSS v3.1
6.7
EPSS
0%
Percentile
14.8
In the wild
Unconfirmed
What it is

A vulnerability in a specific CLI command that is run on Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the configuration database of an affected device. This vulnerability is due to insufficient validation of specific CLI command parameters. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content of the configuration database and gain root-level access to an affected device.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00245 · 14.8th percentile
Weakness
CWE-668 · Exposure of Resource to Wrong Sphere
Published
2021-09-23T02:25Z
EPSS history
Timeline
  • 23 SEP 02:25Z
    Cisco IOS XE SD-WAN Software Arbitrary File Overwrite Vulnerability
    cvelistv5