CVE-2021-1571

High

Description

Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.

SeverityHigh

CVSS7.2

Exploit probability—

Product

Cisco Sf220-24 Firmware

PublishedJun 16, 2021

First seenJun 16, 2021

Weakness typeCWE-287Improper authentication

How to fix

Update

cisco sf220-24_firmware1.2.0.6 or later
cisco sf220-24p_firmware1.2.0.6 or later
cisco sf220-48_firmware1.2.0.6 or later
cisco sf220-48p_firmware1.2.0.6 or later
cisco sg220-26_firmware1.2.0.6 or later
cisco sg220-26p_firmware1.2.0.6 or later
cisco sg220-28mp_firmware1.2.0.6 or later
cisco sg220-50_firmware1.2.0.6 or later
cisco sg220-50p_firmware1.2.0.6 or later

Vendor advisories

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E

Affected products

Product	Affected versions	Fixed in
cisco sf220-24_firmware	v < 1.2.0.6	1.2.0.6
cisco sf220-24p_firmware	v < 1.2.0.6	1.2.0.6
cisco sf220-48_firmware	v < 1.2.0.6	1.2.0.6
cisco sf220-48p_firmware	v < 1.2.0.6	1.2.0.6
cisco sg220-26_firmware	v < 1.2.0.6	1.2.0.6
cisco sg220-26p_firmware	v < 1.2.0.6	1.2.0.6
cisco sg220-28mp_firmware	v < 1.2.0.6	1.2.0.6
cisco sg220-50_firmware	v < 1.2.0.6	1.2.0.6
cisco sg220-50p_firmware	v < 1.2.0.6	1.2.0.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.