CVE-2021-1264
Critical
Description
A vulnerability in the Command Runner tool of Cisco DNA Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation by the Command Runner tool. An attacker could exploit this vulnerability by providing crafted input during command execution or via a crafted command runner API call. A successful exploit could allow the attacker to execute arbitrary CLI commands on devices managed by Cisco DNA Center.
SeverityCritical
CVSS9.6
Exploit probability—
Product
Cisco Catalyst Center
PublishedJan 20, 2021
First seenJan 20, 2021
Weakness typeCWE-78OS command injection
How to fix
Update
- cisco catalyst_center1.3.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco catalyst_center | v < 1.3.1.0 | 1.3.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.