SB2021092306 - Improper access control in Cisco IOS XE SD-WAN Software
Published: September 23, 2021
Security Bulletin ID
SB2021092306
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper access control (CVE-ID: CVE-2021-34724)
The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to insufficient file system protection and the presence of a sensitive file in the bootflash directory. A local administrator can overwrite an installer file stored in the bootflash directory with arbitrary commands to read and write changes to the configuration database on the affected device.
Remediation
Install update from vendor's website.