CVE-2021-34700: cisco catalyst_sd-wan_manager Insufficiently Protected Credentials

Vulnerability summary

CVE-2021-34700 is a medium (CVSS 5.5) Insufficiently Protected Credentials vulnerability in cisco catalyst_sd-wan_manager. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.7% of scored vulnerabilities.

Timeline

1. 22-07-2021
   PublishedVulnerability first disclosed.
2. 07-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the CLI interface of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read arbitrary files on the underlying file system of an affected system. This vulnerability exists because access to sensitive information on an affected system is not sufficiently controlled. An attacker could exploit this vulnerability by gaining unauthorized access to sensitive information on an affected system. A successful exploit could allow the attacker to create forged authentication requests and gain unauthorized access to the web UI of an affected system.

• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.