CVE-2021-1435

HIGH IN THE WILD

Cisco IOS XE - Authenticated Remote Code Execution via Web UI Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-1435 has been observed exploited in the wild (reported by InTheWild.io).

Description

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the root user. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to the web UI of an affected device with arbitrary commands injected into a portion of the request. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

References (1)

Core 1

Scores

CVSS v3 7.2
EPSS 0.0045
EPSS Percentile 63.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

InTheWild.io 2023-10-18
CWE
CWE-22
Status published
Products (36)
cisco/ios_xe 16.9.1
cisco/ios_xe 16.9.1a
cisco/ios_xe 16.9.1b
cisco/ios_xe 16.9.1c
cisco/ios_xe 16.9.1d
cisco/ios_xe 16.9.1s
cisco/ios_xe 16.9.2
cisco/ios_xe 16.9.2a
cisco/ios_xe 16.9.2s
cisco/ios_xe 16.9.3
... and 26 more
Published Mar 24, 2021
Tracked Since Feb 18, 2026