Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-1423

A vulnerability in the implementation of a CLI command in Cisco Aironet Access Points (AP) could allow an authenticated, local attacker to overwrite files in the flash memory of the device. This vulnerability is due to insufficient input validation for a specific command. An attacker could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to overwrite or create files with data that is already present in other files that are hosted on the affected device.

Published

2021-03-24T21:15:13.443

Last Modified

2024-11-21T05:44:19.837

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.4 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

3.9

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-668
  • Type: Primary
    CWE-668
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cisco aironet_access_point_software - Yes
Hardware cisco 1100_integrated_services_router - No
Hardware cisco aironet_1540 - No
Hardware cisco aironet_1560 - No
Hardware cisco aironet_1800 - No
Hardware cisco aironet_2800 - No
Hardware cisco aironet_3800 - No
Hardware cisco aironet_4800 - No
Hardware cisco catalyst_9100 - No
Hardware cisco catalyst_iw6300 - No
Hardware cisco esw6300 - No
Operating System cisco catalyst_9800_firmware < 16.12.5 Yes
Operating System cisco catalyst_9800_firmware ≤ 17.2 Yes
Hardware cisco catalyst_9800 - No
Application cisco wireless_lan_controller_software < 8.5.171.0 Yes
Application cisco wireless_lan_controller_software < 8.10.130.0 Yes
References