CVE-2021-1281
Assigner: cisco
Published: 2021-03-24T00:00:00
State: PUBLISHED
affected: product: Cisco IOS XE Software 
vendor: Cisco
versions: status: affected
version: n/a
datePublic: 2021-03-24T00:00:00
descriptions: value: A vulnerability in CLI management in Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system as the root user. This vulnerability is due to the way the software handles concurrent CLI sessions. An attacker could exploit this vulnerability by authenticating to the device as an administrative user and executing a sequence of commands. A successful exploit could allow the attacker to obtain access to the underlying operating system as the root user.
exploits: value: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. 
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-399
description: CWE-399
type: CWE
source: advisory: cisco-sa-sdwan-clipriv-9TO2QGVp
defect: CSCvv65659
discovery: INTERNAL
title: Cisco IOS XE SD-WAN Software Privilege Escalation Vulnerability