Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-1437

A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device. This vulnerability is due to an unrestricted Trivial File Transfer Protocol (TFTP) configuration. An attacker could exploit this vulnerability by sending a specific TFTP request to an affected device. A successful exploit could allow the attacker to download any file from the filesystem of the affected access point (AP).

Published

2021-03-24T20:15:14.900

Last Modified

2024-11-21T05:44:21.730

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-275
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cisco aironet_access_point_software - Yes
Hardware cisco 1100_integrated_services_router - No
Hardware cisco aironet_1540 - No
Hardware cisco aironet_1560 - No
Hardware cisco aironet_1800 - No
Hardware cisco aironet_2800 - No
Hardware cisco aironet_3800 - No
Hardware cisco aironet_4800 - No
Hardware cisco catalyst_9100 - No
Hardware cisco catalyst_iw6300 - No
Hardware cisco esw6300 - No
Operating System cisco catalyst_9800_firmware < 17.3.3 Yes
Hardware cisco catalyst_9800 - No
Application cisco wireless_lan_controller_software < 8.10.142.0 Yes
References