CVE-2021-1393

Critical

Description

Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operations or to learn device-specific information, create diagnostic files, and make limited configuration changes. For more information about these vulnerabilities, see the Details section of this advisory.

SeverityCritical

CVSS9.8

Exploit probability—

Product

Cisco Application Services Engine

PublishedFeb 24, 2021

First seenFeb 24, 2021

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

cisco application_services_engine1.1\(3e\) or later

Vendor advisories

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-case-mvuln-dYrDPC6w

Affected products

Product	Affected versions	Fixed in
cisco application_services_engine	1.1 ≤ v < 1.1\(3e\)	1.1\(3e\)
cisco application_policy_infrastructure_controller	1.1.3	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.