CVE-2021-1396: Cisco Application Services Engine Unauthorized Access Vulnerabilities
First published: Wed Feb 24 2021(Updated: )
Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operations or to learn device-specific information, create diagnostic files, and make limited configuration changes. For more information about these vulnerabilities, see the Details section of this advisory.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Application Services Engine | >=1.1<1.1\(3e\) | |
| Cisco Application Policy Infrastructure Controller | =1.1.3-c | |
| Cisco Application Policy Infrastructure Controller | =1.1.3-d |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-1396?
CVE-2021-1396 is a vulnerability in Cisco Application Services Engine that could allow an unauthenticated remote attacker to gain privileged access to host-level operations or to learn device-specific information.
How severe is CVE-2021-1396?
CVE-2021-1396 has a severity score of 6.5, which is considered critical.
Which software is affected by CVE-2021-1396?
The Cisco Application Services Engine versions 1.1 up to and including 1.1(3e) and Cisco Application Policy Infrastructure Controller version 1.1.3-c and 1.1.3-d are affected by CVE-2021-1396.
How can an attacker exploit CVE-2021-1396?
An unauthenticated remote attacker can exploit CVE-2021-1396 to gain privileged access to host-level operations or to learn device-specific information, create diagnostic files, and make limited configuration changes.
Where can I find more information about CVE-2021-1396?
You can find more information about CVE-2021-1396 in the Cisco Security Advisory: [Cisco Security Advisory](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-case-mvuln-dYrDPC6w).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco application services engine
- version/cisco application services engine/1.1
- canonical/cisco application policy infrastructure controller
- version/cisco application policy infrastructure controller/1.1.3-c
- version/cisco application policy infrastructure controller/1.1.3-d