CVE-2021-1462 - Vulnerability Details

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-vman-kth3c82B

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system. To exploit this vulnerability, an attacker would need to have a valid Administrator account on an affected system. The vulnerability is due to incorrect privilege assignment. An attacker could exploit this vulnerability by logging in to an affected system with an Administrator account and creating a malicious file, which the system would parse at a later time. A successful exploit could allow the attacker to obtain root privileges on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Title		Cisco SD-WAN vManage Software Privilege Escalation Vulnerability
Weaknesses		CWE-20
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-vman-kth3c82B
Metrics		cvssV3_0 `{'score': 4.4, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:X/RL:X/RC:X'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-1462", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2020-11-13T00:00:00.000Z", "datePublished": "2024-11-18T15:30:12.049Z", "dateUpdated": "2024-11-18T15:51:45.679Z"}, "containers": {"cna": {"title": "Cisco SD-WAN vManage Software Privilege Escalation Vulnerability", "metrics": [{"format": "cvssV3_0", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:X/RL:X/RC:X", "baseScore": 4.4, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in the CLI of Cisco&nbsp;SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system. To exploit this vulnerability, an attacker would need to have a valid Administrator account on an affected system.\r\nThe vulnerability is due to incorrect privilege assignment. An attacker could exploit this vulnerability by logging in to an affected system with an Administrator account and creating a malicious file, which the system would parse at a later time. A successful exploit could allow the attacker to obtain root privileges on the affected system.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-vman-kth3c82B", "name": "cisco-sa-sdwan-privesc-vman-kth3c82B"}], "exploits": [{"lang": "en", "value": "The Cisco\u00a0Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-sdwan-privesc-vman-kth3c82B", "discovery": "INTERNAL", "defects": ["CSCvt11534"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Input Validation", "type": "cwe", "cweId": "CWE-20"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Catalyst SD-WAN Manager", "versions": [{"version": "20.1.12", "status": "affected"}, {"version": "19.2.1", "status": "affected"}, {"version": "18.4.4", "status": "affected"}, {"version": "18.4.5", "status": "affected"}, {"version": "20.1.1.1", "status": "affected"}, {"version": "20.1.1", "status": "affected"}, {"version": "19.3.0", "status": "affected"}, {"version": "19.2.2", "status": "affected"}, {"version": "19.2.099", "status": "affected"}, {"version": "18.3.6", "status": "affected"}, {"version": "18.3.7", "status": "affected"}, {"version": "19.2.0", "status": "affected"}, {"version": "18.3.8", "status": "affected"}, {"version": "19.0.0", "status": "affected"}, {"version": "19.1.0", "status": "affected"}, {"version": "18.4.302", "status": "affected"}, {"version": "18.4.303", "status": "affected"}, {"version": "19.2.097", "status": "affected"}, {"version": "19.2.098", "status": "affected"}, {"version": "17.2.10", "status": "affected"}, {"version": "18.3.6.1", "status": "affected"}, {"version": "19.0.1a", "status": "affected"}, {"version": "18.2.0", "status": "affected"}, {"version": "18.4.3", "status": "affected"}, {"version": "18.4.1", "status": "affected"}, {"version": "17.2.8", "status": "affected"}, {"version": "18.3.3.1", "status": "affected"}, {"version": "18.4.0", "status": "affected"}, {"version": "18.3.1", "status": "affected"}, {"version": "17.2.6", "status": "affected"}, {"version": "17.2.9", "status": "affected"}, {"version": "18.3.4", "status": "affected"}, {"version": "17.2.5", "status": "affected"}, {"version": "18.3.1.1", "status": "affected"}, {"version": "18.3.5", "status": "affected"}, {"version": "18.4.0.1", "status": "affected"}, {"version": "18.3.3", "status": "affected"}, {"version": "17.2.7", "status": "affected"}, {"version": "17.2.4", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-11-18T15:30:12.049Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-18T15:51:27.804209Z", "id": "CVE-2021-1462", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-18T15:51:45.679Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2021-1462 (string)

assignerOrgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

state : PUBLISHED (string)

assignerShortName : cisco (string)

dateReserved : 2020-11-13T00:00:00.000Z (string)

datePublished : 2024-11-18T15:30:12.049Z (string)

dateUpdated : 2024-11-18T15:51:45.679Z (string)

}

containers : { »

cna : { »

title : Cisco SD-WAN vManage Software Privilege Escalation Vulnerability (string)

metrics : [ »

0 : { »

format : cvssV3_0 (string)

cvssV3_0 : { »

version : 3.0 (string)

vectorString : CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:X/RL:X/RC:X (string)

baseScore : 4.4 (number)

baseSeverity : MEDIUM (string)

attackVector : LOCAL (string)

attackComplexity : LOW (string)

privilegesRequired : HIGH (string)

userInteraction : NONE (string)

scope : UNCHANGED (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

availabilityImpact : NONE (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system. To exploit this vulnerability, an attacker would need to have a valid Administrator account on an affected system. The vulnerability is due to incorrect privilege assignment. An attacker could exploit this vulnerability by logging in to an affected system with an Administrator account and creating a malicious file, which the system would parse at a later time. A successful exploit could allow the attacker to obtain root privileges on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. (string)

}

]

references : [ »

0 : { »

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-vman-kth3c82B (string)

name : cisco-sa-sdwan-privesc-vman-kth3c82B (string)

}

]

exploits : [ »

0 : { »

lang : en (string)

value : The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. (string)

}

]

source : { »

advisory : cisco-sa-sdwan-privesc-vman-kth3c82B (string)

discovery : INTERNAL (string)

defects : [ »

0 : CSCvt11534 (string)

]

}

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

description : Improper Input Validation (string)

type : cwe (string)

cweId : CWE-20 (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Cisco (string)

product : Cisco Catalyst SD-WAN Manager (string)

versions : [ »

0 : { »

version : 20.1.12 (string)

status : affected (string)

}

1 : { »

version : 19.2.1 (string)

status : affected (string)

}

2 : { »

version : 18.4.4 (string)

status : affected (string)

}

3 : { »

version : 18.4.5 (string)

status : affected (string)

}

4 : { »

version : 20.1.1.1 (string)

status : affected (string)

}

5 : { »

version : 20.1.1 (string)

status : affected (string)

}

6 : { »

version : 19.3.0 (string)

status : affected (string)

}

7 : { »

version : 19.2.2 (string)

status : affected (string)

}

8 : { »

version : 19.2.099 (string)

status : affected (string)

}

9 : { »

version : 18.3.6 (string)

status : affected (string)

}

10 : { »

version : 18.3.7 (string)

status : affected (string)

}

11 : { »

version : 19.2.0 (string)

status : affected (string)

}

12 : { »

version : 18.3.8 (string)

status : affected (string)

}

13 : { »

version : 19.0.0 (string)

status : affected (string)

}

14 : { »

version : 19.1.0 (string)

status : affected (string)

}

15 : { »

version : 18.4.302 (string)

status : affected (string)

}

16 : { »

version : 18.4.303 (string)

status : affected (string)

}

17 : { »

version : 19.2.097 (string)

status : affected (string)

}

18 : { »

version : 19.2.098 (string)

status : affected (string)

}

19 : { »

version : 17.2.10 (string)

status : affected (string)

}

20 : { »

version : 18.3.6.1 (string)

status : affected (string)

}

21 : { »

version : 19.0.1a (string)

status : affected (string)

}

22 : { »

version : 18.2.0 (string)

status : affected (string)

}

23 : { »

version : 18.4.3 (string)

status : affected (string)

}

24 : { »

version : 18.4.1 (string)

status : affected (string)

}

25 : { »

version : 17.2.8 (string)

status : affected (string)

}

26 : { »

version : 18.3.3.1 (string)

status : affected (string)

}

27 : { »

version : 18.4.0 (string)

status : affected (string)

}

28 : { »

version : 18.3.1 (string)

status : affected (string)

}

29 : { »

version : 17.2.6 (string)

status : affected (string)

}

30 : { »

version : 17.2.9 (string)

status : affected (string)

}

31 : { »

version : 18.3.4 (string)

status : affected (string)

}

32 : { »

version : 17.2.5 (string)

status : affected (string)

}

33 : { »

version : 18.3.1.1 (string)

status : affected (string)

}

34 : { »

version : 18.3.5 (string)

status : affected (string)

}

35 : { »

version : 18.4.0.1 (string)

status : affected (string)

}

36 : { »

version : 18.3.3 (string)

status : affected (string)

}

37 : { »

version : 17.2.7 (string)

status : affected (string)

}

38 : { »

version : 17.2.4 (string)

status : affected (string)

}

]

defaultStatus : unknown (string)

}

]

providerMetadata : { »

orgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

shortName : cisco (string)

dateUpdated : 2024-11-18T15:30:12.049Z (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-11-18T15:51:27.804209Z (string)

id : CVE-2021-1462 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-18T15:51:45.679Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-1462", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-18T15:51:27.804209Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-18T15:51:31.901Z"}}], "cna": {"title": "Cisco SD-WAN vManage Software Privilege Escalation Vulnerability", "source": {"defects": ["CSCvt11534"], "advisory": "cisco-sa-sdwan-privesc-vman-kth3c82B", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_0", "cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:X/RL:X/RC:X", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Catalyst SD-WAN Manager", "versions": [{"status": "affected", "version": "20.1.12"}, {"status": "affected", "version": "19.2.1"}, {"status": "affected", "version": "18.4.4"}, {"status": "affected", "version": "18.4.5"}, {"status": "affected", "version": "20.1.1.1"}, {"status": "affected", "version": "20.1.1"}, {"status": "affected", "version": "19.3.0"}, {"status": "affected", "version": "19.2.2"}, {"status": "affected", "version": "19.2.099"}, {"status": "affected", "version": "18.3.6"}, {"status": "affected", "version": "18.3.7"}, {"status": "affected", "version": "19.2.0"}, {"status": "affected", "version": "18.3.8"}, {"status": "affected", "version": "19.0.0"}, {"status": "affected", "version": "19.1.0"}, {"status": "affected", "version": "18.4.302"}, {"status": "affected", "version": "18.4.303"}, {"status": "affected", "version": "19.2.097"}, {"status": "affected", "version": "19.2.098"}, {"status": "affected", "version": "17.2.10"}, {"status": "affected", "version": "18.3.6.1"}, {"status": "affected", "version": "19.0.1a"}, {"status": "affected", "version": "18.2.0"}, {"status": "affected", "version": "18.4.3"}, {"status": "affected", "version": "18.4.1"}, {"status": "affected", "version": "17.2.8"}, {"status": "affected", "version": "18.3.3.1"}, {"status": "affected", "version": "18.4.0"}, {"status": "affected", "version": "18.3.1"}, {"status": "affected", "version": "17.2.6"}, {"status": "affected", "version": "17.2.9"}, {"status": "affected", "version": "18.3.4"}, {"status": "affected", "version": "17.2.5"}, {"status": "affected", "version": "18.3.1.1"}, {"status": "affected", "version": "18.3.5"}, {"status": "affected", "version": "18.4.0.1"}, {"status": "affected", "version": "18.3.3"}, {"status": "affected", "version": "17.2.7"}, {"status": "affected", "version": "17.2.4"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco\u00a0Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-vman-kth3c82B", "name": "cisco-sa-sdwan-privesc-vman-kth3c82B"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the CLI of Cisco&nbsp;SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system. To exploit this vulnerability, an attacker would need to have a valid Administrator account on an affected system.\r\nThe vulnerability is due to incorrect privilege assignment. An attacker could exploit this vulnerability by logging in to an affected system with an Administrator account and creating a malicious file, which the system would parse at a later time. A successful exploit could allow the attacker to obtain root privileges on the affected system.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-20", "description": "Improper Input Validation"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-11-18T15:30:12.049Z"}}}, "cveMetadata": {"cveId": "CVE-2021-1462", "state": "PUBLISHED", "dateUpdated": "2024-11-18T15:51:45.679Z", "dateReserved": "2020-11-13T00:00:00.000Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2024-11-18T15:30:12.049Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2021-1462 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-11-18T15:51:27.804209Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-18T15:51:31.901Z (string)

}

]

cna : { »

title : Cisco SD-WAN vManage Software Privilege Escalation Vulnerability (string)

source : { »

defects : [ »

0 : CSCvt11534 (string)

]

advisory : cisco-sa-sdwan-privesc-vman-kth3c82B (string)

discovery : INTERNAL (string)

}

metrics : [ »

0 : { »

format : cvssV3_0 (string)

cvssV3_0 : { »

scope : UNCHANGED (string)

version : 3.0 (string)

baseScore : 4.4 (number)

attackVector : LOCAL (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:X/RL:X/RC:X (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : HIGH (string)

confidentialityImpact : NONE (string)

}

]

affected : [ »

0 : { »

vendor : Cisco (string)

product : Cisco Catalyst SD-WAN Manager (string)

versions : [ »

0 : { »

status : affected (string)

version : 20.1.12 (string)

}

1 : { »

status : affected (string)

version : 19.2.1 (string)

}

2 : { »

status : affected (string)

version : 18.4.4 (string)

}

3 : { »

status : affected (string)

version : 18.4.5 (string)

}

4 : { »

status : affected (string)

version : 20.1.1.1 (string)

}

5 : { »

status : affected (string)

version : 20.1.1 (string)

}

6 : { »

status : affected (string)

version : 19.3.0 (string)

}

7 : { »

status : affected (string)

version : 19.2.2 (string)

}

8 : { »

status : affected (string)

version : 19.2.099 (string)

}

9 : { »

status : affected (string)

version : 18.3.6 (string)

}

10 : { »

status : affected (string)

version : 18.3.7 (string)

}

11 : { »

status : affected (string)

version : 19.2.0 (string)

}

12 : { »

status : affected (string)

version : 18.3.8 (string)

}

13 : { »

status : affected (string)

version : 19.0.0 (string)

}

14 : { »

status : affected (string)

version : 19.1.0 (string)

}

15 : { »

status : affected (string)

version : 18.4.302 (string)

}

16 : { »

status : affected (string)

version : 18.4.303 (string)

}

17 : { »

status : affected (string)

version : 19.2.097 (string)

}

18 : { »

status : affected (string)

version : 19.2.098 (string)

}

19 : { »

status : affected (string)

version : 17.2.10 (string)

}

20 : { »

status : affected (string)

version : 18.3.6.1 (string)

}

21 : { »

status : affected (string)

version : 19.0.1a (string)

}

22 : { »

status : affected (string)

version : 18.2.0 (string)

}

23 : { »

status : affected (string)

version : 18.4.3 (string)

}

24 : { »

status : affected (string)

version : 18.4.1 (string)

}

25 : { »

status : affected (string)

version : 17.2.8 (string)

}

26 : { »

status : affected (string)

version : 18.3.3.1 (string)

}

27 : { »

status : affected (string)

version : 18.4.0 (string)

}

28 : { »

status : affected (string)

version : 18.3.1 (string)

}

29 : { »

status : affected (string)

version : 17.2.6 (string)

}

30 : { »

status : affected (string)

version : 17.2.9 (string)

}

31 : { »

status : affected (string)

version : 18.3.4 (string)

}

32 : { »

status : affected (string)

version : 17.2.5 (string)

}

33 : { »

status : affected (string)

version : 18.3.1.1 (string)

}

34 : { »

status : affected (string)

version : 18.3.5 (string)

}

35 : { »

status : affected (string)

version : 18.4.0.1 (string)

}

36 : { »

status : affected (string)

version : 18.3.3 (string)

}

37 : { »

status : affected (string)

version : 17.2.7 (string)

}

38 : { »

status : affected (string)

version : 17.2.4 (string)

}

]

defaultStatus : unknown (string)

}

]

exploits : [ »

0 : { »

lang : en (string)

value : The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. (string)

}

]

references : [ »

0 : { »

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-vman-kth3c82B (string)

name : cisco-sa-sdwan-privesc-vman-kth3c82B (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system. To exploit this vulnerability, an attacker would need to have a valid Administrator account on an affected system. The vulnerability is due to incorrect privilege assignment. An attacker could exploit this vulnerability by logging in to an affected system with an Administrator account and creating a malicious file, which the system would parse at a later time. A successful exploit could allow the attacker to obtain root privileges on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : cwe (string)

cweId : CWE-20 (string)

description : Improper Input Validation (string)

}

]

}

]

providerMetadata : { »

orgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

shortName : cisco (string)

dateUpdated : 2024-11-18T15:30:12.049Z (string)

}

cveMetadata : { »

cveId : CVE-2021-1462 (string)

state : PUBLISHED (string)

dateUpdated : 2024-11-18T15:51:45.679Z (string)

dateReserved : 2020-11-13T00:00:00.000Z (string)

assignerOrgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

datePublished : 2024-11-18T15:30:12.049Z (string)

assignerShortName : cisco (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the CLI of Cisco&nbsp;SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system. To exploit this vulnerability, an attacker would need to have a valid Administrator account on an affected system.\r\nThe vulnerability is due to incorrect privilege assignment. An attacker could exploit this vulnerability by logging in to an affected system with an Administrator account and creating a malicious file, which the system would parse at a later time. A successful exploit could allow the attacker to obtain root privileges on the affected system.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."}], "id": "CVE-2021-1462", "lastModified": "2024-11-18T17:11:17.393", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 0.8, "impactScore": 3.6, "source": "ykramarz@cisco.com", "type": "Secondary"}]}, "published": "2024-11-18T16:15:11.087", "references": [{"source": "ykramarz@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-vman-kth3c82B"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "ykramarz@cisco.com", "type": "Primary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system. To exploit this vulnerability, an attacker would need to have a valid Administrator account on an affected system. The vulnerability is due to incorrect privilege assignment. An attacker could exploit this vulnerability by logging in to an affected system with an Administrator account and creating a malicious file, which the system would parse at a later time. A successful exploit could allow the attacker to obtain root privileges on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. (string)

}

]

id : CVE-2021-1462 (string)

lastModified : 2024-11-18T17:11:17.393 (string)

metrics : { »

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 4.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 0.8 (number)

impactScore : 3.6 (number)

source : ykramarz@cisco.com (string)

type : Secondary (string)

}

]

}

published : 2024-11-18T16:15:11.087 (string)

references : [ »

0 : { »

source : ykramarz@cisco.com (string)

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-vman-kth3c82B (string)

}

]

sourceIdentifier : ykramarz@cisco.com (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-20 (string)

}

]

source : ykramarz@cisco.com (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object