CVE-2021-1546 : A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to improper protections on file access through the CLI. An attacker could exploit this vulnerability by running a CLI command that targets an arbitrary file on the local system. A successful exploit could allow the attacker to return portions of an arbitrary file, possibly resulting in the disclosure of sensitive information.

Published 2021-09-23 03:15:11

Updated 2023-10-16 16:35:25

Source Cisco Systems, Inc.

View at NVD, CVE.org

Products affected by CVE-2021-1546

Cisco » Vedge 100 Firmware
Versions from including (>=) 18.4 and before (<) 20.4.2
cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 100 » Version: N/A
Cisco » Vedge 100 Firmware
Versions from including (>=) 20.5 and before (<) 20.5.2
cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 100 » Version: N/A
Cisco » Vedge 100 Firmware
Versions from including (>=) 20.6 and before (<) 20.6.1
cpe:2.3:o:cisco:vedge_100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 100 » Version: N/A
Cisco » Vedge 1000 Firmware
Versions from including (>=) 20.5 and before (<) 20.5.2
cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 1000 » Version: N/A
Cisco » Vedge 1000 Firmware
Versions from including (>=) 18.4 and before (<) 20.4.2
cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 1000 » Version: N/A
Cisco » Vedge 1000 Firmware
Versions from including (>=) 20.6 and before (<) 20.6.1
cpe:2.3:o:cisco:vedge_1000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 1000 » Version: N/A
Cisco » Vedge 2000 Firmware
Versions from including (>=) 18.4 and before (<) 20.4.2
cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 2000 » Version: N/A
Cisco » Vedge 2000 Firmware
Versions from including (>=) 20.6 and before (<) 20.6.1
cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 2000 » Version: N/A
Cisco » Vedge 2000 Firmware
Versions from including (>=) 20.5 and before (<) 20.5.2
cpe:2.3:o:cisco:vedge_2000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 2000 » Version: N/A
Cisco » Vedge 5000 Firmware
Versions from including (>=) 18.4 and before (<) 20.4.2
cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 5000 » Version: N/A
Cisco » Vedge 5000 Firmware
Versions from including (>=) 20.5 and before (<) 20.5.2
cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 5000 » Version: N/A
Cisco » Vedge 5000 Firmware
Versions from including (>=) 20.6 and before (<) 20.6.1
cpe:2.3:o:cisco:vedge_5000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 5000 » Version: N/A
Cisco » Vedge 100b Firmware
Versions from including (>=) 18.4 and before (<) 20.4.2
cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 100b » Version: N/A
Cisco » Vedge 100b Firmware
Versions from including (>=) 20.5 and before (<) 20.5.2
cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 100b » Version: N/A
Cisco » Vedge 100b Firmware
Versions from including (>=) 20.6 and before (<) 20.6.1
cpe:2.3:o:cisco:vedge_100b_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 100b » Version: N/A
Cisco » Vedge 100m Firmware
Versions from including (>=) 20.6 and before (<) 20.6.1
cpe:2.3:o:cisco:vedge_100m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 100m » Version: N/A
Cisco » Vedge 100m Firmware
Versions from including (>=) 20.5 and before (<) 20.5.2
cpe:2.3:o:cisco:vedge_100m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 100m » Version: N/A
Cisco » Vedge 100m Firmware
Versions from including (>=) 18.4 and before (<) 20.4.2
cpe:2.3:o:cisco:vedge_100m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 100m » Version: N/A
Cisco » Vedge 100wm Firmware
Versions from including (>=) 18.4 and before (<) 20.4.2
cpe:2.3:o:cisco:vedge_100wm_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 100wm » Version: N/A
Cisco » Vedge 100wm Firmware
Versions from including (>=) 20.5 and before (<) 20.5.2
cpe:2.3:o:cisco:vedge_100wm_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 100wm » Version: N/A
Cisco » Vedge 100wm Firmware
Versions from including (>=) 20.6 and before (<) 20.6.1
cpe:2.3:o:cisco:vedge_100wm_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge 100wm » Version: N/A
Cisco » Sd-wan Vbond Orchestrator
Versions from including (>=) 20.5 and before (<) 20.5.2
cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*
Matching versions
Cisco » Sd-wan Vbond Orchestrator
Versions from including (>=) 18.4 and before (<) 20.4.2
cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*
Matching versions
Cisco » Sd-wan Vbond Orchestrator
Versions from including (>=) 20.6 and before (<) 20.6.1
cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*
Matching versions
Cisco » Sd-wan Vmanage
Versions from including (>=) 20.5 and before (<) 20.5.2
cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*
Matching versions
Cisco » Vsmart Controller Firmware
Versions from including (>=) 20.6 and before (<) 20.6.1
cpe:2.3:o:cisco:vsmart_controller_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vsmart Controller » Version: N/A
Cisco » Vsmart Controller Firmware
Versions from including (>=) 18.4 and before (<) 20.4.2
cpe:2.3:o:cisco:vsmart_controller_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vsmart Controller » Version: N/A
Cisco » Vsmart Controller Firmware
Versions from including (>=) 20.5 and before (<) 20.5.2
cpe:2.3:o:cisco:vsmart_controller_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vsmart Controller » Version: N/A
Cisco » Vedge Cloud Firmware
Versions from including (>=) 18.4 and before (<) 20.4.2
cpe:2.3:o:cisco:vedge_cloud_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge Cloud » Version: N/A
Cisco » Vedge Cloud Firmware
Versions from including (>=) 20.5 and before (<) 20.5.2
cpe:2.3:o:cisco:vedge_cloud_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge Cloud » Version: N/A
Cisco » Vedge Cloud Firmware
Versions from including (>=) 20.6 and before (<) 20.6.1
cpe:2.3:o:cisco:vedge_cloud_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Vedge Cloud » Version: N/A
Cisco » Catalyst Sd-wan Manager
Versions from including (>=) 18.4 and before (<) 20.4.2
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
Matching versions
Cisco » Catalyst Sd-wan Manager
Versions from including (>=) 20.6 and before (<) 20.6.1
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-1546

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-1546

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	Cisco Systems, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2021-1546

CWE-209 Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.
Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)

References for CVE-2021-1546

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-Fhqh8pKX

Cisco SD-WAN Software Information Disclosure Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2021-1546

Products affected by CVE-2021-1546

Exploit prediction scoring system (EPSS) score for CVE-2021-1546

CVSS scores for CVE-2021-1546

CWE ids for CVE-2021-1546

References for CVE-2021-1546