CVE-2021-1281 MEDIUM

CVE-2021-1281: Cisco IOS XE SD-WAN Software Privilege Escalation Vulnerability

Vendor Cisco
Product Cisco IOS XE Software
Weakness CWE-399
Published March 24, 2021
Last update November 8, 2024

CVSS base score

5.1/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

What the vulnerability does

01Description

A vulnerability in CLI management in Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system as the root user. This vulnerability is due to the way the software handles concurrent CLI sessions. An attacker could exploit this vulnerability by authenticating to the device as an administrative user and executing a sequence of commands. A successful exploit could allow the attacker to obtain access to the underlying operating system as the root user.

Key dates

02Disclosure timeline

March 24, 2021 CVE published
November 8, 2024 Record updated