CVE-2021-1384

 

Published at: - 24-03-2021 09:15

Last modified: - 29-07-2022 03:52

Total changes: - 4

Description

A vulnerability in Cisco IOx application hosting environment of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands into the underlying operating system as the root user. This vulnerability is due to incomplete validation of fields in the application packages loaded onto IOx. An attacker could exploit this vulnerability by creating a crafted application .tar file and loading it onto the device. A successful exploit could allow the attacker to perform command injection into the underlying operating system as the root user.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• 20210324 Cisco IOx for IOS XE Software Command Injection Vulnerability-Vendor Advisory
• https://github.com/orangecertcc/security-research/security/advisories/GHSA-h332-fj6p-2232

 

Keywords

NVD

 

CVE-2021-1384

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures