CVE-2021-1612: medium-severity vulnerability in Cisco IOS XE SD-WAN Software
Cisco IOS XE SD-WAN Software Arbitrary File Overwrite Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.5epss 0.3%
A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to overwrite arbitrary files on the local system. This vulnerability is due to improper access controls on files within the local file system. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on an affected device.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
Cisco · Cisco IOS XE SD-WAN SoftwareRelated CVEs — Cisco IOS XE SD-WAN Software
In the same product, most dangerous first.
CVE-2021-34727CRITICALCisco IOS XE SD-WAN Software Buffer Overflow VulnerabilityEPSS 2.6%CVE-2020-3216MEDIUMCisco IOS XE SD-WAN Software Authentication Bypass VulnerabilityEPSS 0.4%CVE-2019-16011HIGHCisco IOS XE SD-WAN Software Command Injection VulnerabilityEPSS 0.4%CVE-2021-34729MEDIUMCisco IOS XE SD-WAN Software Command Injection VulnerabilityEPSS 0.4%CVE-2021-34725MEDIUMCisco IOS XE SD-WAN Software Command Injection VulnerabilityEPSS 0.4%CVE-2019-1950HIGHCisco IOS XE SD-WAN Software Default Credentials VulnerabilityEPSS 0.3%