CVE-2021-1438: Cisco Wide Area Application Services Software Information Disclosure Vulnerability
First published: Thu May 06 2021(Updated: )
A vulnerability in Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to gain access to sensitive information on an affected device. The vulnerability is due to improper input validation and authorization of specific commands that a user can execute within the CLI. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the attacker to read arbitrary files that they originally did not have permissions to access.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Wide Area Application Services | <=6.4.5a |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-1438?
CVE-2021-1438 has a medium severity rating due to its potential to allow sensitive information disclosure.
Who is affected by CVE-2021-1438?
CVE-2021-1438 affects users of Cisco Wide Area Application Services versions up to 6.4.5a.
How do I fix CVE-2021-1438?
To fix CVE-2021-1438, it is recommended to upgrade to a patched version of Cisco Wide Area Application Services.
What type of attacker can exploit CVE-2021-1438?
CVE-2021-1438 can be exploited by an authenticated, local attacker.
What causes the vulnerability CVE-2021-1438?
CVE-2021-1438 is caused by improper input validation and authorization of specific commands in Cisco WAAS.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/title
- agent/description
- agent/tags
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/cisco
- canonical/cisco wide area application services
- version/cisco wide area application services/6.4.5a