A vulnerability in Cisco IOx application hosting environment of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands into the underlying operating system as the root user. This vulnerability is due to incomplete validation of fields in the application packages loaded onto IOx. An attacker could exploit this vulnerability by creating a crafted application .tar file and loading it onto the device. A successful exploit could allow the attacker to perform command injection into the underlying operating system as the root user.
References
| Link | Resource |
|---|---|
| https://github.com/orangecertcc/security-research/security/advisories/GHSA-h332-fj6p-2232 | Exploit Third Party Advisory |
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-cmdinj-RkSURGHG | Vendor Advisory |
| https://github.com/orangecertcc/security-research/security/advisories/GHSA-h332-fj6p-2232 | Exploit Third Party Advisory |
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-cmdinj-RkSURGHG | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:44
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 8.5
v3 : 6.5 |
| References | () https://github.com/orangecertcc/security-research/security/advisories/GHSA-h332-fj6p-2232 - Exploit, Third Party Advisory | |
| References | () https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-cmdinj-RkSURGHG - Vendor Advisory |
Information
Published : 2021-03-24 20:15
Updated : 2024-11-21 05:44
NVD link : CVE-2021-1384
Mitre link : CVE-2021-1384
CVE.ORG link : CVE-2021-1384
JSON object : View
Products Affected
cisco
- ios_xe