Code Injection in Cisco Adaptive Security Device Manager (ASDM) - CVE-2021-1585
Published: July 8, 2021 / Updated: February 16, 2022
Vulnerability identifier: #VU54620
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-1585
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a lack of proper signature verification for specific code exchanged between the ASDM and the Launcher. A remote attacker can leverage a man-in-the-middle position on the network and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Cisco Adaptive Security Device Manager (ASDM)
How to mitigate CVE-2021-1585
Install updates from vendor's website.