CVE-2021-1436 MEDIUM

CVE-2021-1436: Cisco IOS XE SD-WAN Software Path Traversal Vulnerability

Vendor Cisco
Product Cisco IOS XE Software
Weakness CWE-22 · Path traversal
Published March 24, 2021
Last update November 8, 2024

CVSS base score

4.4/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to view arbitrary files on the affected system.

Key dates

02Disclosure timeline

March 24, 2021 CVE published
November 8, 2024 Record updated