CVE-2021-1612
Assigner: cisco
Published: 2021-09-22T00:00:00
State: PUBLISHED
affected: product: Cisco IOS XE SD-WAN Software 
vendor: Cisco
versions: status: affected
version: n/a
datePublic: 2021-09-22T00:00:00
descriptions: value: A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to overwrite arbitrary files on the local system. This vulnerability is due to improper access controls on files within the local file system. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on an affected device.
exploits: value: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. 
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-61
description: CWE-61
type: CWE
source: advisory: cisco-sa-sd-wan-GjR5pGOm
defect: CSCvt63238
discovery: INTERNAL
title: Cisco IOS XE SD-WAN Software Arbitrary File Overwrite Vulnerability