#VU54620 Code Injection in Cisco Adaptive Security Device Manager (ASDM) - CVE-2021-1585
Published: July 8, 2021 / Updated: February 16, 2022
Vulnerability identifier: #VU54620
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2021-1585
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
Cisco Adaptive Security Device Manager (ASDM)
Cisco Adaptive Security Device Manager (ASDM)
Software vendor:
Cisco Systems, Inc
Cisco Systems, Inc
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a lack of proper signature verification for specific code exchanged between the ASDM and the Launcher. A remote attacker can leverage a man-in-the-middle position on the network and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install updates from vendor's website.