CVE-2021-1434 MEDIUM

CVE-2021-1434: Cisco IOS XE SD-WAN Software Arbitrary File Corruption Vulnerability

Vendor Cisco
Product Cisco IOS XE Software
Weakness CWE-552 · Files accessible externally
Published March 24, 2021
Last update November 8, 2024

CVSS base score

4.4/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system. This vulnerability is due to insufficient validation of the parameters of a specific CLI command. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content of any arbitrary file that resides on the underlying host file system.

Key dates

02Disclosure timeline

March 24, 2021 CVE published
November 8, 2024 Record updated