Medium severity · published Nov 15, 2024
CVE-2021-1464
Cisco SD-WAN vManage Authorization Bypass Vulnerability
5.0
CVSS
1.3%
EPSS
No
On KEV
Description
A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization checking and gain restricted access to the configuration information of an affected system. This vulnerability exists because the affected software has insufficient input validation for certain commands. An attacker could exploit this vulnerability by sending crafted requests to the affected commands of an affected system. A successful exploit could allow the attacker to bypass authorization checking and gain restricted access to the configuration data of the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Cisco Catalyst SD-WAN Manager · Cisco
20.1.12; 19.2.1; 18.4.4; 18.4.5; 20.1.1.1; 20.1.1; +34 more · source: vendor
CS
Catalyst Sd-wan Manager · Cisco
17.2.4; 17.2.5; 17.2.6; 17.2.7; 17.2.8; 17.2.9; +34 more · source: NVD