CVE-2021-1515: Cisco SD-WAN vManage Information Disclosure Vulnerability
A vulnerability in Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to gain access to sensitive information. This vulnerability is due to improper access controls on API endpoints when Cisco SD-WAN vManage Software is running in multi-tenant mode. An attacker with access to a device that is managed in the multi-tenant environment could exploit this vulnerability by sending a request to an affected API endpoint on the vManage system. A successful exploit could allow the attacker to gain access to sensitive information that may include hashed credentials that could be used in future attacks.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-1515.
What is the severity of CVE-2021-1515?
The severity of CVE-2021-1515 is medium with a CVSS base score of 4.3.
How does the vulnerability in Cisco SD-WAN vManage Software occur?
The vulnerability in Cisco SD-WAN vManage Software occurs due to improper access controls on API endpoints when running in multi-tenant mode.
Who can exploit this vulnerability?
An unauthenticated, adjacent attacker can exploit this vulnerability.
How can I fix CVE-2021-1515?
To fix CVE-2021-1515, it is recommended to upgrade to a version of Cisco SD-WAN vManage Software that is not affected by this vulnerability.