Wap125 Firmware
CVE-2021-1549
HIGH
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper validation of user-supplied input. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit these vulnerabilities, the attacker must have valid administrative credentials for the device.
AnalysisAI
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper validation of user-supplied input. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit these vulnerabilities, the attacker must have valid administrative credentials for the device. Affected products include: Cisco Wap125 Firmware, Cisco Wap131 Firmware, Cisco Wap150 Firmware, Cisco Wap351 Firmware, Cisco Wap361 Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.
More in Wap125 Firmware
View allMultiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series
A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Smal
A vulnerability in the web-based user interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allo
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today