CVE-2021-1144— Cisco Connected Mobile Experiences Privilege Escalation Vulnerability
Quick assessment
Affected
Cisco Cisco Connected Mobile Experiences
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco Connected Mobile Experiences是美国思科（Cisco）公司的一个互联移动体验。 Cisco Connected Mobile Experiences 存在访问控制错误漏洞，该漏洞允许远程、经过身份验证、没有管理权限的攻击者更改受影响系统上任何用户的密码。该漏洞是由于修改密码的授权检查处理不当造成的。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-1144
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Connected Mobile Experiences Privilege Escalation Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow a remote, authenticated attacker without administrative privileges to alter the password of any user on an affected system. The vulnerability is due to incorrect handling of authorization checks for changing a password. An authenticated attacker without administrative privileges could exploit this vulnerability by sending a modified HTTP request to an affected device. A successful exploit could allow the attacker to alter the passwords of any user on the system, including an administrative user, and then impersonate that user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco Connected Mobile Experiences 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Connected Mobile Experiences是美国思科（Cisco）公司的一个互联移动体验。 Cisco Connected Mobile Experiences 存在访问控制错误漏洞，该漏洞允许远程、经过身份验证、没有管理权限的攻击者更改受影响系统上任何用户的密码。该漏洞是由于修改密码的授权检查处理不当造成的。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Connected Mobile Experiences | n/a | - |
|
II. Public POCs for CVE-2021-1144
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-1144
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-1144 (1)
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmxpe-75Asy9k vendor-advisory x_refsource_CISCO
Same Patch Batch · Cisco · 2021-01-13 · 96 CVEs total
| CVE-2021-1237 | 7.8 HIGH | Cisco AnyConnect Secure Mobility Client for Windows DLL Injection Vulnerability |
| CVE-2021-1196 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1186 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1360 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1187 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1190 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1193 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1194 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1195 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1188 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1192 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1185 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1184 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1183 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1182 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1181 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1180 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1179 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1178 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
| CVE-2021-1177 | 7.2 HIGH | Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote |
Showing top 20 of 96 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Cisco Connected Mobile Experiences
-
CVE-2021-1522
Cisco Connected Mobile Experiences Strong Authentication Req -
CVE-2021-1143
Cisco Connected Mobile Experiences User Enumeration Vulnerab -
CVE-2020-3151
Cisco Connected Mobile Experiences Restricted Shell Escape V -
CVE-2020-3152
Cisco Connected Mobile Experiences Privilege Escalation Vuln -
CVE-2019-1645
Cisco Connected Mobile Experiences Information Disclosure Vu
Same vendor: Cisco
-
CVE-2026-76504
Cisco Catalyst SD-WAN Manager System Account Authorization B -
CVE-2026-76426
Cisco ISE REST API SQL Injection Vulnerability -
CVE-2026-20121
CIsco FTD Bypass Access List -
CVE-2026-76431
Cisco Identity Services Engine Arbitrary File Deletion Vulne -
CVE-2026-76427
Cisco ISE XML External Entity Injection Vulnerability
Same weakness: CWE-863
-
CVE-2026-103758
Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-con -
CVE-2026-103284
Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedb -
CVE-2026-103273
Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff -
CVE-2026-103271
Ghost 4.0.0 before 6.63.0 Restricted Content Bypass -
CVE-2026-103266
Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Ac
V. Comments for CVE-2021-1144
No comments yet