CVE-2021-1392 HIGH

CVE-2021-1392: Cisco IOS and IOS XE Software Common Industrial Protocol Privilege Escalation Vulnerability

Vendor Cisco
Product Cisco IOS
Weakness CWE-522 · Insufficiently protected credentials
Published March 24, 2021
Last update November 8, 2024
View on NVD All CVEs

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A vulnerability in the CLI command permissions of Cisco IOS and Cisco IOS XE Software could allow an authenticated, local attacker to retrieve the password for Common Industrial Protocol (CIP) and then remotely configure the device as an administrative user. This vulnerability exists because incorrect permissions are associated with the show cip security CLI command. An attacker could exploit this vulnerability by issuing the command to retrieve the password for CIP on an affected device. A successful exploit could allow the attacker to reconfigure the device.

Key dates

02Disclosure timeline

March 24, 2021 CVE published
November 8, 2024 Record updated