Skip to main content

Catalyst Sd Wan Manager CVE-2021-1512

MEDIUM
Files or Directories Accessible to External Parties (CWE-552)
2021-05-06 psirt@cisco.com
Cisco Path Traversal Information Disclosure Catalyst Sd Wan Manager Sd Wan Vbond Orchestrator Sd Wan Vmanage Vsmart Controller Firmware Vedge 100 Firmware Vedge 1000 Firmware Vedge 100B Firmware Vedge 100M Firmware Vedge 100Wm Firmware Vedge 2000 Firmware Vedge 5000 Firmware Vedge Cloud Firmware
6.0
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.0 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
May 06, 2021 - 13:15 nvd
MEDIUM 6.0

DescriptionNVD

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system of an affected system. This vulnerability is due to insufficient validation of the user-supplied input parameters of a specific CLI command. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content in any arbitrary files that reside on the underlying host file system.

AnalysisAI

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system of an affected system. Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-552. A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system of an affected system. This vulnerability is due to insufficient validation of the user-supplied input parameters of a specific CLI command. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content in any arbitrary files that reside on the underlying host file system. Affected products include: Cisco Catalyst Sd-Wan Manager, Cisco Sd-Wan Vbond Orchestrator, Cisco Sd-Wan Vmanage, Cisco Vsmart Controller Firmware, Cisco Vedge 100 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Catalyst Sd Wan Manager

View all
CVE-2026-20127 CRITICAL POC
10.0 Feb 25

Cisco Catalyst SD-WAN Controller and Manager contain a critical authentication bypass (CVE-2026-20127, CVSS 10.0) in the
CVE-2022-20775 HIGH POC
7.8 Sep 30

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privil
CVE-2026-20129 CRITICAL
9.8 Feb 25

Authentication bypass in Cisco Catalyst SD-WAN Manager API allows unauthenticated remote access to the management platfo
CVE-2023-20252 CRITICAL
9.8 Sep 27

A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could al
CVE-2021-1468 CRITICAL
9.8 May 06

Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arb
CVE-2021-1479 CRITICAL
9.8 Apr 08

Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arb
CVE-2021-1301 CRITICAL
9.8 Jan 20

Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks aga
CVE-2021-1300 CRITICAL
9.8 Jan 20

Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks aga
CVE-2023-20214 CRITICAL
9.1 Aug 03

A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow a
CVE-2026-20126 HIGH
8.8 Feb 25

Catalyst Sd-Wan Manager contains a vulnerability that allows attackers to an authenticated, local attacker with low priv
CVE-2022-20696 HIGH
8.8 Sep 08

A vulnerability in the binding configuration of Cisco SD-WAN vManage Software containers could allow an unauthenticated,
CVE-2021-1508 HIGH
8.8 May 06

Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arb

Same weakness CWE-552 – Files or Directories Accessible to External Parties

View all
CVE-2016-3715 MEDIUM POC
5.5
CVE-2017-16651 HIGH POC
7.8
CVE-2023-6266 HIGH POC
7.5
CVE-2021-22015 HIGH POC
7.8
CVE-2017-14942 CRITICAL POC
9.8
CVE-2015-5211 CRITICAL POC
9.6
CVE-2020-37082 CRITICAL POC
9.8
CVE-2024-53676 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6

Share

CVE-2021-1512 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy