CVE-2021-1485: medium-severity vulnerability in Cisco IOS XR Software
Cisco IOS XR Software Command Injection Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.6epss 0.3%
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges on the underlying Linux operating system (OS) of an affected device. This vulnerability is due to insufficient input validation of commands that are supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to an affected command. A successful exploit could allow the attacker to execute commands on the underlying Linux OS with root privileges.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Affected products
Cisco · Cisco IOS XR SoftwareRelated CVEs — Cisco IOS XR Software
In the same product, most dangerous first.
CVE-2020-3118HIGHCisco IOS XR Software Cisco Discovery Protocol Format String VulnerabilityEPSS 11.7%KEVCVE-2022-20821MEDIUMCisco IOS XR Software Health Check Open Port VulnerabilityEPSS 11.5%KEVCVE-2020-3566HIGHCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityEPSS 3.7%KEVCVE-2020-3569HIGHCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilitiesEPSS 3.3%KEVCVE-2025-20363CRITICALCVE-2025-20363EPSS 7.2%CVE-2020-3284HIGHCisco IOS XR Software Enhanced Preboot eXecution Environment Unsigned Code Execution VulnerabilityEPSS 2.9%