What is the CVSS score of CVE-2021-1528?

CVE-2021-1528 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Catalyst Sd Wan Manager CVE-2021-1528

HIGH

Execution with Unnecessary Privileges (CWE-250)

2021-06-04 psirt@cisco.com

Cisco Privilege Escalation Catalyst Sd Wan Manager Sd Wan Vbond Orchestrator Vsmart Controller Vedge 100 Firmware Vedge 1000 Firmware Vedge 100B Firmware Vedge 100M Firmware Vedge 100Wm Firmware Vedge 2000 Firmware Vedge 5000 Firmware Vedge Cloud Firmware

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 04, 2021 - 17:15 nvd

HIGH 7.8

DescriptionNVD

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulnerability exists because the affected software does not properly restrict access to privileged processes. An attacker could exploit this vulnerability by invoking a privileged process in the affected system. A successful exploit could allow the attacker to perform actions with the privileges of the root user.

AnalysisAI

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-250. A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulnerability exists because the affected software does not properly restrict access to privileged processes. An attacker could exploit this vulnerability by invoking a privileged process in the affected system. A successful exploit could allow the attacker to perform actions with the privileges of the root user. Affected products include: Cisco Catalyst Sd-Wan Manager, Cisco Sd-Wan Vbond Orchestrator, Cisco Vsmart Controller, Cisco Vedge 100 Firmware, Cisco Vedge 1000 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.