CVE-2021-1434: cisco cisco ios xe software

Vulnerability summary

CVE-2021-1434 is a medium (CVSS 6.6) vulnerability in cisco cisco ios xe software. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.9% of scored vulnerabilities.

Timeline

1. 24-03-2021
   PublishedVulnerability first disclosed.
2. 08-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system. This vulnerability is due to insufficient validation of the parameters of a specific CLI command. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content of any arbitrary file that resides on the underlying host file system.

• CWE-552Files or Directories Accessible to External PartiesThe product makes files or directories accessible to unauthorized actors, even though they should not be.