High severity · published May 6, 2021
CVE-2021-1401
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote…
7.2
CVSS
2%
EPSS
No
On KEV
Description
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Wap125 Firmware · Cisco
through 1.0.3.1 · source: NVD
WF
Wap131 Firmware · Cisco
through 1.0.2.17 · source: NVD
WF
Wap150 Firmware · Cisco
through 1.1.2.4 · source: NVD
WF
Wap351 Firmware · Cisco
through 1.0.2.17 · source: NVD
WF
Wap361 Firmware · Cisco
through 1.1.2.4 · source: NVD
WF
Wap581 Firmware · Cisco
through 1.0.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-1401
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-1401
Third Party Advisory
http://jvn.jp/en/jp/JVN71263107/index.html
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-multi-ZAfKGXhF
More from Wap125 Firmware
8.8
CVE-2021-1400
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote…
7.2
CVE-2021-1555
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote…
7.2
CVE-2021-1554
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote…
7.2
CVE-2021-1553
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote…
7.2
CVE-2021-1552
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote…