Cisco has patched multiple vulnerabilities in Cisco SD-WAN, Small Business routers, Unified Communications Products and Advanced Malware Protection. Two of those vulnerabilities (CVE-2021-1479, CVE-2021-1459) are rated Critical.
An attacker could remotely exploit some of these vulnerabilities to take control of an impacted system.
SD-WAN vulnerabilities
Cisco patched three SD-WAN vManage software vulnerabilities on April 7, 2021. The vulnerabilities (CVE-2021-1137, CVE-2021-1479 and CVE-2021-1480) could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system.
Each are summarized below:
- CVE-2021-1479: Critical Cisco SD-WAN vManage Remote Management Buffer Overflow Vulnerability.
- CVE-2021-1137: Cisco SD-WAN vManage Privilege Escalation Vulnerability.
- CVE-2021-1480: Cisco SD-WAN vManage Privilege Escalation Vulnerability.
The most severe of the three vulnerabilities CVE-2021-1479 is rated Critical and has a CVSS score of 9.8.
“An attacker could exploit this vulnerability by sending a crafted connection request to the vulnerable component that, when processed, could cause a buffer overflow condition. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system with root privileges,” Cisco warned in the advisory.
Each of the other High severity Privileged Escalation vulnerabilities have a CVSS score of 7.8.
Small Business Router vulnerabilities
In addition, Cisco patched multiple vulnerabilities in Small Business Router products as illustrated below:
- CVE-2021-1459: Critical Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability (CVSS score: 9.8).
- CVE-2021-1472: Cisco Small Business RV Series Routers Authentication Bypass File Upload Vulnerability (CVSS score 5.3)
- CVE-2021-1473: Cisco Small Business RV340 Series Routers Command Injection Vulnerability (CVSS score 7.3).
- CVE-2021-1309: Cisco Small Business RV Series Routers Link Layer Discovery Protocol Remote Code Execution and Denial of Service Vulnerability (CVSS score 8.8)..
- CVE-2021-1251: Cisco Small Business RV Series Routers Link Layer Discovery Protocol Memory Leak Denial of Service Vulnerability (CVSS score 7.4).
- CVE-2021-1308: Cisco Small Business RV Series Routers Link Layer Discovery Protocol Denial of Service Vulnerability (CVSS score 7.4).
Other Products
Finally, Cisco also patched vulnerabilities in Unified Communications and Advanced Malware Protection products as noted below:
- CVE-2021-1362: Cisco Unified Communications Products Remote Code Execution Vulnerability (CVSS score 8.8).
- CVE-2021-1386: Cisco Advanced Malware Protection for Endpoints Windows Connector, ClamAV for Windows, and Immunet DLL Hijacking Vulnerability (CVSS score 7.0).
Readers can also check out Cisco’s security advisories page for more details on most recent Cisco product vulnerabilities and mitigations.