CVE-2021-1264: Cisco DNA Center Command Runner Command Injection Vulnerability
A vulnerability in the Command Runner tool of Cisco DNA Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation by the Command Runner tool. An attacker could exploit this vulnerability by providing crafted input during command execution or via a crafted command runner API call. A successful exploit could allow the attacker to execute arbitrary CLI commands on devices managed by Cisco DNA Center.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Cisco DNA Center vulnerability?
The vulnerability ID for this Cisco DNA Center vulnerability is CVE-2021-1264.
What is the severity of CVE-2021-1264?
The severity of CVE-2021-1264 is critical with a severity value of 8.8.
How can an attacker exploit CVE-2021-1264?
An attacker can exploit CVE-2021-1264 by performing a command injection attack through the Command Runner tool of Cisco DNA Center.
What is the affected software for CVE-2021-1264?
The affected software for CVE-2021-1264 is Cisco DNA Center up to version 1.3.1.0.
Is there a fix available for CVE-2021-1264?
Yes, Cisco has released a security advisory with fixes and mitigations for CVE-2021-1264. Please refer to the Cisco Security Advisory for more information.