SB2021092306 - Improper access control in Cisco IOS XE SD-WAN Software

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021092306

SB2021092306 - Improper access control in Cisco IOS XE SD-WAN Software

Published: September 23, 2021

Security Bulletin ID SB2021092306
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper access control (CVE-ID: CVE-2021-34724)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to insufficient file system protection and the presence of a sensitive file in the bootflash directory. A local administrator can overwrite an installer file stored in the bootflash directory with arbitrary commands to read and write changes to the configuration database on the affected device.


Remediation

Install update from vendor's website.

References