CVE-2021-1476 MEDIUM

CVE-2021-1476: Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Command Injection Vulnerability

Vendor Cisco
Product Cisco Adaptive Security Appliance (ASA) Software
Weakness CWE-78
Published April 29, 2021
Last update November 8, 2024

CVSS base score

6.7/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A vulnerability in the CLI of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS) of an affected device. The vulnerability is due to insufficient input validation of commands that are supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input for specific commands. A successful exploit could allow the attacker to execute commands on the underlying OS with root privileges. To exploit this vulnerability, an attacker must have valid administrator-level credentials.

Key dates

02Disclosure timeline

April 29, 2021 CVE published
November 8, 2024 Record updated