CVE-2021-1423 MEDIUM

CVE-2021-1423: Cisco Aironet Access Points Arbitrary File Overwrite Vulnerability

Vendor Cisco
Product Cisco Aironet Access Point Software
Weakness CWE-668
Published March 24, 2021
Last update November 8, 2024

CVSS base score

4.4/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

A vulnerability in the implementation of a CLI command in Cisco Aironet Access Points (AP) could allow an authenticated, local attacker to overwrite files in the flash memory of the device. This vulnerability is due to insufficient input validation for a specific command. An attacker could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to overwrite or create files with data that is already present in other files that are hosted on the affected device.

Key dates

02Disclosure timeline

March 24, 2021 CVE published
November 8, 2024 Record updated