VDB
CVE-2021-1435
CVE-2021-1435
PUBLISHED
CVSS 6.599999904632568 MEDIUM
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the root user. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to the web UI of an affected device with arbitrary commands injected into a portion of the request. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
EPSS 0.45% · 64.0th percentile
Risk Scores
CVSS 3.0
6.599999904632568
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.45%
64.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| cisco | ios_xe | 16.9.1a, 16.9.1c, 16.9.1d |
| Cisco | Cisco IOS XE Software | n/a |
Exploit Intelligence
- CIRCL seen: CVE-2021-1435 (circl-sighting)
- 20210324 Cisco IOS XE Software Web UI Command Injection Vulnerability (circl)
Timeline
- Mar 24, 2021 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 1, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Jan 8, 2023 EPSS Score