CVE-2021-1589: Cisco SD-WAN vManage Software Disaster Recovery Feature Password Exposure Vulnerability
First published: Thu Sep 23 2021(Updated: )
A vulnerability in the disaster recovery feature of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain unauthorized access to user credentials. This vulnerability exists because access to API endpoints is not properly restricted. An attacker could exploit this vulnerability by sending a request to an API endpoint. A successful exploit could allow the attacker to gain unauthorized access to administrative credentials that could be used in further attacks.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco SD-WAN | >=20.3<20.3.4 | |
| Cisco SD-WAN | >=20.4<20.4.2 | |
| Cisco SD-WAN | >=20.5<20.5.2 | |
| Cisco SD-WAN | >=20.6<20.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-1589?
CVE-2021-1589 is a vulnerability in the disaster recovery feature of Cisco SD-WAN vManage Software that allows an authenticated, remote attacker to gain unauthorized access to user credentials.
How does CVE-2021-1589 impact Cisco SD-WAN vManage Software?
CVE-2021-1589 allows an attacker to exploit the vulnerability in the disaster recovery feature of Cisco SD-WAN vManage Software, resulting in unauthorized access to user credentials.
Is an attacker required to be authenticated to exploit CVE-2021-1589?
Yes, an attacker needs to be authenticated to exploit CVE-2021-1589 and gain unauthorized access to user credentials.
What is the severity of CVE-2021-1589?
CVE-2021-1589 has a severity rating of 6.5 out of 10, indicating a medium-level vulnerability.
How can I fix CVE-2021-1589 in Cisco SD-WAN vManage Software?
To fix CVE-2021-1589, it is recommended to apply the necessary patches or updates provided by Cisco.
- collector/nvd-index
- agent/weakness
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/references
- agent/author
- agent/title
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/cisco
- canonical/cisco sd-wan
- version/cisco sd-wan/20.3
- version/cisco sd-wan/20.4
- version/cisco sd-wan/20.5
- version/cisco sd-wan/20.6