Write-what-where Condition in Cisco Systems, Inc products - CVE-2021-1390
Published: March 29, 2021
Vulnerability identifier: #VU51766
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-1390
CWE-ID: CWE-123
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the affected software permits modification of the run-time memory of an affected device under specific circumstances. A local administrator can trigger a logic error in the code that was designed to restrict run-time memory modifications and execute arbitrary code on the underlying Linux operating system.
Affected software
Cisco Catalyst IE3200 Rugged Series
Cisco Catalyst IE3300 Rugged Series
Cisco Catalyst IE3400 Rugged Series
Cisco Catalyst IE3400 Heavy Duty Series
Cisco Embedded Services 3300 Series Switches
Cisco IOS XE
Cisco Catalyst IE3300 Rugged Series
Cisco Catalyst IE3400 Rugged Series
Cisco Catalyst IE3400 Heavy Duty Series
Cisco Embedded Services 3300 Series Switches
Cisco IOS XE
How to mitigate CVE-2021-1390
Install updates from vendor's website.
Cisco IOS XE - addressed in versions 16.9.6.59, 16.9.7, 16.12.4.42, 16.12.5, 16.12.5a, 17.1.3, 17.3.0.211, 17.3.1, 17.3.1w, 17.3.1x, 17.3.1a, 17.3.1.9, 17.3.2, 17.3.2a, 17.3.3, 17.4.0.72, 17.4.1, 17.4.1a, 17.4.1b