CVEvulnerability

CVE-2021-1384

7.2 HIGH Published 2021-03-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-03-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
8.5 HIGH — AV:N/AC:M/Au:S/C:C/I:C/A:C
Weaknesses
CWE-77, CWE-78

Description

A vulnerability in Cisco IOx application hosting environment of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands into the underlying operating system as the root user. This vulnerability is due to incomplete validation of fields in the application packages loaded onto IOx. An attacker could exploit this vulnerability by creating a crafted application .tar file and loading it onto the device. A successful exploit could allow the attacker to perform command injection into the underlying operating system as the root user.

Affected configurations

• cisco ios xe (< 16.6.9) • cisco ios xe (>= 16.9.0 < 16.9.7) • cisco ios xe (>= 17.3.2 < 17.3.3) • cisco ios xe (>= 17.4.0 < 17.4.2) • cisco ios xe 17.5.0

Related

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References