Missing XML Validation in Cisco AsyncOS for Secure Web Appliance - CVE-2021-1359
Published: July 8, 2021
Vulnerability identifier: #VU54607
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-1359
CWE-ID: CWE-112
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient validation of user-supplied XML input for the web interface. A remote authenticated attacker can upload specially crafted XML configuration files to execute arbitrary commands on the underlying operating system and elevate privileges to root.
Affected software
Cisco AsyncOS for Secure Web Appliance
How to mitigate CVE-2021-1359
Install updates from vendor's website.
Cisco AsyncOS for Secure Web Appliance - addressed in versions 12.0.3 005, 12.5.2