CVE-2021-1585: Cisco Adaptive Security Device Manager Remote Code Execution Vulnerability
First published: Thu Jul 08 2021(Updated: )
A vulnerability in the Cisco Adaptive Security Device Manager (ASDM) Launcher could allow an unauthenticated, remote attacker to execute arbitrary code on a user's operating system. This vulnerability is due to a lack of proper signature verification for specific code exchanged between the ASDM and the Launcher. An attacker could exploit this vulnerability by leveraging a man-in-the-middle position on the network to intercept the traffic between the Launcher and the ASDM and then inject arbitrary code. A successful exploit could allow the attacker to execute arbitrary code on the user's operating system with the level of privileges assigned to the ASDM Launcher. A successful exploit may require the attacker to perform a social engineering attack to persuade the user to initiate communication from the Launcher to the ASDM.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Adaptive Security Device Manager | <=9.16.1 | |
| Cisco Adaptive Security Device Manager | <7.18.1.152 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco Adaptive Security Device Manager (ASDM) Launcher vulnerability?
The vulnerability ID for this Cisco Adaptive Security Device Manager (ASDM) Launcher vulnerability is CVE-2021-1585.
What is the severity of CVE-2021-1585?
The severity of CVE-2021-1585 is critical with a CVSS score of 8.1.
How can an unauthenticated, remote attacker exploit CVE-2021-1585?
An unauthenticated, remote attacker can exploit CVE-2021-1585 to execute arbitrary code on a user's operating system.
Which version of the Cisco Adaptive Security Device Manager (ASDM) is affected by CVE-2021-1585?
Version 9.16.1 of the Cisco Adaptive Security Device Manager (ASDM) is affected by CVE-2021-1585.
Are there any fixes or patches available for CVE-2021-1585?
Refer to the Cisco Security Advisory and the Rapid7 blog post for information on fixes or patches available for CVE-2021-1585.
- collector/nvd-index
- collector/nvd-api
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/cisco
- canonical/cisco adaptive security device manager
- version/cisco adaptive security device manager/9.16.1