#VU51763 Active Debug Code in Cisco Systems, Inc products - CVE-2021-1398
Published: March 29, 2021
Vulnerability identifier: #VU51763
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2021-1398
CWE-ID: CWE-489
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Cisco IOS XE
Integrated Services Virtual Routers
Cloud Services Router 1000V Series
Cisco IOS XE
Integrated Services Virtual Routers
Cloud Services Router 1000V Series
Software vendor:
Cisco Systems, Inc
Cisco Systems, Inc
Description
The vulnerability allows a local attacker to execute arbitrary code on the system.
The vulnerability exists due to incorrect validations of specific function arguments that are passed to the boot script. An attacker with physical access can tamper with a specific file, execute unsigned code at boot time and bypass the image verification check in the secure boot process of the affected device.
Remediation
Install updates from vendor's website.