CVE-2021-1301

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-1301
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:cisco:ios_xe_sd-wan:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:sd-wan_firmware:18.3.8:*:*:*:*:*:*:*
cpe:2.3:o:cisco:sd-wan_firmware:18.4.4:*:*:*:*:*:*:*
cpe:2.3:o:cisco:sd-wan_firmware:19.2.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:sd-wan_firmware:19.2.99:*:*:*:*:*:*:*
cpe:2.3:o:cisco:sd-wan_vsmart_controller_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:vedge_100_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_1000_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_100b_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_100m_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_100wm_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_2000_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_5000_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:-:*:*:*:*:*:*:*
History

06 Oct 2023, 16:24

Type Values Removed Values Added
CPE cpe:2.3:a:cisco:sd-wan_manager:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:catalyst_sd-wan_manager:-:*:*:*:*:*:*:*
First Time Cisco catalyst Sd-wan Manager

29 Sep 2023, 15:03

Type Values Removed Values Added
CPE cpe:2.3:a:cisco:sd-wan_vmanage:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:sd-wan_manager:-:*:*:*:*:*:*:*
First Time Cisco sd-wan Manager
Information

Published : 2021-01-20 20:15

Updated : 2024-02-28 18:08

NVD link : CVE-2021-1301

Mitre link : CVE-2021-1301

CVE.ORG link : CVE-2021-1301

JSON object : View

Products Affected

cisco

  • sd-wan_vsmart_controller_firmware
  • sd-wan_firmware
  • vedge_100wm_router
  • vedge_2000_router
  • ios_xe_sd-wan
  • vedge_cloud_router
  • vedge_100_router
  • sd-wan_vbond_orchestrator
  • vedge_100m_router
  • vedge_5000_router
  • vedge_1000_router
  • vedge_100b_router
  • catalyst_sd-wan_manager
CWE
CWE-20

Improper Input Validation

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer