mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-01 11:11:27 +00:00
384 lines
15 KiB
JSON
384 lines
15 KiB
JSON
|
{
|
||
|
|
"id": "CVE-2021-34725",
|
||
|
|
"sourceIdentifier": "ykramarz@cisco.com",
|
||
|
|
"published": "2021-09-23T03:15:19.093",
|
||
|
|
"lastModified": "2022-10-24T15:15:05.887",
|
||
|
|
"vulnStatus": "Analyzed",
|
||
|
|
"descriptions": [
|
||
|
|
{
|
||
|
|
"lang": "en",
|
||
|
|
"value": "A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to an affected device and submitting crafted input to the CLI. The attacker must be authenticated as an administrative user to execute the affected commands. A successful exploit could allow the attacker to execute commands with root-level privileges."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"lang": "es",
|
||
|
|
"value": "Una vulnerabilidad en la CLI de Cisco IOS XE SD-WAN Software podr\u00eda permitir a un atacante local autenticado inyectar comandos arbitrarios para ejecutarlos con privilegios de nivel de root en el sistema operativo subyacente. Esta vulnerabilidad es debido a una insuficiente comprobaci\u00f3n de entrada en determinados comandos de la CLI. Un atacante podr\u00eda explotar esta vulnerabilidad al autenticarse en un dispositivo afectado y enviando entradas dise\u00f1adas a la CLI. El atacante debe estar autenticado como usuario administrativo para ejecutar los comandos afectados. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante ejecutar comandos con privilegios de nivel de root"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"metrics": {
|
||
|
|
"cvssMetricV31": [
|
||
|
|
{
|
||
|
|
"source": "nvd@nist.gov",
|
||
|
|
"type": "Primary",
|
||
|
|
"cvssData": {
|
||
|
|
"version": "3.1",
|
||
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||
|
|
"attackVector": "LOCAL",
|
||
|
|
"attackComplexity": "LOW",
|
||
|
|
"privilegesRequired": "HIGH",
|
||
|
|
"userInteraction": "NONE",
|
||
|
|
"scope": "UNCHANGED",
|
||
|
|
"confidentialityImpact": "HIGH",
|
||
|
|
"integrityImpact": "HIGH",
|
||
|
|
"availabilityImpact": "HIGH",
|
||
|
|
"baseScore": 6.7,
|
||
|
|
"baseSeverity": "MEDIUM"
|
||
|
|
},
|
||
|
|
"exploitabilityScore": 0.8,
|
||
|
|
"impactScore": 5.9
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"cvssMetricV30": [
|
||
|
|
{
|
||
|
|
"source": "ykramarz@cisco.com",
|
||
|
|
"type": "Secondary",
|
||
|
|
"cvssData": {
|
||
|
|
"version": "3.0",
|
||
|
|
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||
|
|
"attackVector": "LOCAL",
|
||
|
|
"attackComplexity": "LOW",
|
||
|
|
"privilegesRequired": "HIGH",
|
||
|
|
"userInteraction": "NONE",
|
||
|
|
"scope": "UNCHANGED",
|
||
|
|
"confidentialityImpact": "HIGH",
|
||
|
|
"integrityImpact": "HIGH",
|
||
|
|
"availabilityImpact": "HIGH",
|
||
|
|
"baseScore": 6.7,
|
||
|
|
"baseSeverity": "MEDIUM"
|
||
|
|
},
|
||
|
|
"exploitabilityScore": 0.8,
|
||
|
|
"impactScore": 5.9
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"cvssMetricV2": [
|
||
|
|
{
|
||
|
|
"source": "nvd@nist.gov",
|
||
|
|
"type": "Primary",
|
||
|
|
"cvssData": {
|
||
|
|
"version": "2.0",
|
||
|
|
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
|
||
|
|
"accessVector": "LOCAL",
|
||
|
|
"accessComplexity": "LOW",
|
||
|
|
"authentication": "NONE",
|
||
|
|
"confidentialityImpact": "COMPLETE",
|
||
|
|
"integrityImpact": "COMPLETE",
|
||
|
|
"availabilityImpact": "COMPLETE",
|
||
|
|
"baseScore": 7.2
|
||
|
|
},
|
||
|
|
"baseSeverity": "HIGH",
|
||
|
|
"exploitabilityScore": 3.9,
|
||
|
|
"impactScore": 10.0,
|
||
|
|
"acInsufInfo": false,
|
||
|
|
"obtainAllPrivilege": false,
|
||
|
|
"obtainUserPrivilege": false,
|
||
|
|
"obtainOtherPrivilege": false,
|
||
|
|
"userInteractionRequired": false
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"weaknesses": [
|
||
|
|
{
|
||
|
|
"source": "nvd@nist.gov",
|
||
|
|
"type": "Primary",
|
||
|
|
"description": [
|
||
|
|
{
|
||
|
|
"lang": "en",
|
||
|
|
"value": "CWE-78"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"source": "ykramarz@cisco.com",
|
||
|
|
"type": "Secondary",
|
||
|
|
"description": [
|
||
|
|
{
|
||
|
|
"lang": "en",
|
||
|
|
"value": "CWE-77"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"configurations": [
|
||
|
|
{
|
||
|
|
"operator": "AND",
|
||
|
|
"nodes": [
|
||
|
|
{
|
||
|
|
"operator": "OR",
|
||
|
|
"negate": false,
|
||
|
|
"cpeMatch": [
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:o:cisco:ios_xe_sd-wan:*:*:*:*:*:*:*:*",
|
||
|
|
"versionEndIncluding": "17.2.1r",
|
||
|
|
"matchCriteriaId": "2108544A-5C67-483F-926E-0830CC7808FA"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"operator": "OR",
|
||
|
|
"negate": false,
|
||
|
|
"cpeMatch": [
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1000:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "91209C16-A620-44A0-9134-8AA456343F29"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1000-esp100:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "3C5C1005-0C12-4EDA-BC4A-B52201C4F516"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "FE2182E7-C813-4966-A36C-E648A9344299"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1000_series:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "76B7C13F-46C5-460A-A6C9-3837A28A0CE2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1000_series_route_processor_\\(rp2\\):-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "C02F9303-F9DF-4166-AB4B-8C26B9FAD109"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1000_series_route_processor_\\(rp3\\):-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "372CB4D6-BB22-4521-9C18-C0A663717168"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "ED7C321E-F083-4AB6-96A0-D6358980441E"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "7594E307-AC80-41EC-AE94-07E664A7D701"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1001-hx_r:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "33208B25-0CBB-4E31-A892-60B7B5625155"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "09C913FF-63D5-43FB-8B39-598EF436BA5A"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1001-x_r:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "241EEBD9-76E4-4AE6-96B8-1C1ACD834F17"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "E4376E56-A21C-4642-A85D-439C8E21CD7F"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "CD2794BD-C8CE-46EF-9857-1723FCF04E46"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1002-hx_r:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "CC03A84F-C8F2-4225-9A00-8FA35368CD57"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "444F688F-79D0-4F22-B530-7BD520080B8F"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1002-x_r:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "51F2A755-556C-4C5E-8622-96D124319AF7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "55DD2272-10C2-43B9-9F13-6DC41DBE179B"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "7428E0A8-1641-47FB-9CA9-34311DEF660D"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "DE7401B7-094C-46EB-9869-2F0372E8B26B"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "8D8A72FD-D8B0-45B5-8FAD-6D8395BB218A"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "854D9594-FE84-4E7B-BA21-A3287F2DC302"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "C81CC6E3-B989-4730-820E-46734E3E608D"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:csr_1000v:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "BF8B0B49-2C99-410B-B011-5B821C5992FB"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1000:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "46BCFE18-6054-49BD-96EF-F890CEF679C4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1100:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "F14743B2-08B6-4BE5-A015-E6356BC40CC9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1100-4g\\/6g:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "EA346B47-08F1-43AC-8BA7-5DE0F2CEB2F7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1100-4p:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "A31F1806-FE38-47D3-941C-9E98174CC606"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1100-8p:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "3DDD3158-F7B3-44D9-8BAB-DECBD6722646"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1101:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "36A484D9-E7AB-4CFB-9E3F-486C3ABCB957"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1101-4p:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "8820861D-210F-470B-BA02-C7D97FA0B0EC"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1109:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "E2DB9B60-7071-430F-83A1-11F3F2BFEB1C"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1109-2p:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "7EC53E58-A39A-4355-A754-143F232DB19C"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1109-4p:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "1C83201C-1CBF-4B45-B766-0DF20D4F3F36"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1111x:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "E3DB9F80-59C5-456A-A2FF-1248A1A9FB8E"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1111x-8p:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "D283AE56-C593-4588-A3A3-700292E25FAC"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_111x:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "4C04E529-D389-4A1D-90FA-24E4F141BBBE"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1120:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "7F14877F-4D77-4EAE-88C2-78AC4347C38A"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_1160:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "B851300F-F83F-43AE-AC65-3A55961F7038"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_4000:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "C44BBDF9-3B42-4D98-9059-2BE30983EC47"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_422:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "92091BFB-318A-444E-9BBA-C0D0A9247D20"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_4221:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "788DE350-6996-417D-8457-114738CBF6AA"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_4321:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "B68ED8CF-67FD-4225-86C4-F872987F147C"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_4331:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "60D2AC16-AB04-4B65-AC50-8079FF4D7F06"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_4351:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "ABFC4AC6-1AD6-4806-BBC4-B306FB46335F"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_4431:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "502D6E81-555C-47B8-93B6-1B189FB237A8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_4451:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "8B6DB4A6-0D01-46A6-88CC-80E4873E88D0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_4451-x:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "C3C877F2-B677-4678-B4FF-704F8C7DB2FA"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": false,
|
||
|
|
"criteria": "cpe:2.3:h:cisco:isr_4461:-:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "291DDB5D-9FA1-4427-96F6-B93B60D2A041"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"references": [
|
||
|
|
{
|
||
|
|
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-maapi-privesc-KSUg7QSS",
|
||
|
|
"source": "ykramarz@cisco.com",
|
||
|
|
"tags": [
|
||
|
|
"Vendor Advisory"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|