CVE-2021-1264: Cisco DNA Center Command Runner Command Injection Vulnerability
First published: Wed Jan 20 2021(Updated: )
A vulnerability in the Command Runner tool of Cisco DNA Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation by the Command Runner tool. An attacker could exploit this vulnerability by providing crafted input during command execution or via a crafted command runner API call. A successful exploit could allow the attacker to execute arbitrary CLI commands on devices managed by Cisco DNA Center.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco DNA Center | <1.3.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco DNA Center vulnerability?
The vulnerability ID for this Cisco DNA Center vulnerability is CVE-2021-1264.
What is the severity of CVE-2021-1264?
The severity of CVE-2021-1264 is critical with a severity value of 8.8.
How can an attacker exploit CVE-2021-1264?
An attacker can exploit CVE-2021-1264 by performing a command injection attack through the Command Runner tool of Cisco DNA Center.
What is the affected software for CVE-2021-1264?
The affected software for CVE-2021-1264 is Cisco DNA Center up to version 1.3.1.0.
Is there a fix available for CVE-2021-1264?
Yes, Cisco has released a security advisory with fixes and mitigations for CVE-2021-1264. Please refer to the Cisco Security Advisory for more information.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/severity
- agent/references
- agent/title
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/cisco
- canonical/cisco dna center