Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2021-1306— Cisco ADE-OS Local File Inclusion Vulnerability

Quick assessment

Affected
Cisco Cisco Identity Services Engine Software
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cisco Prime Infrastructure是美国思科（Cisco）公司的一个应用软件。用于简化无线和有线网络的管理。 Cisco 多款产品存在安全漏洞，攻击者可利用该漏洞识别目录并向文件系统写入任意文件。以下产品及版本受到影响：Cisco Evolved Programmable Network (EPN) Manager, Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure。

CVSS 4.4 · Medium EPSS 0.21% · P12
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-1306

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cisco ADE-OS Local File Inclusion Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the restricted shell of Cisco Evolved Programmable Network (EPN) Manager, Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure could allow an authenticated, local attacker to identify directories and write arbitrary files to the file system. This vulnerability is due to improper validation of parameters that are sent to a CLI command within the restricted shell. An attacker could exploit this vulnerability by logging in to the device and issuing certain CLI commands. A successful exploit could allow the attacker to identify file directories on the affected device and write arbitrary files to the file system on the affected device. To exploit this vulnerability, the attacker must be an authenticated shell user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco 多款产品安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Prime Infrastructure是美国思科（Cisco）公司的一个应用软件。用于简化无线和有线网络的管理。 Cisco 多款产品存在安全漏洞，攻击者可利用该漏洞识别目录并向文件系统写入任意文件。以下产品及版本受到影响：Cisco Evolved Programmable Network (EPN) Manager, Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Cisco Cisco Identity Services Engine Software n/a -

II. Public POCs for CVE-2021-1306

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-1306

请登录查看更多情报信息。

Vendor Advisories for CVE-2021-1306 (1)

Same Patch Batch · Cisco · 2021-05-22 · 18 CVEs total

CVE-2021-1487 8.8 HIGH Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Command Injectio
CVE-2021-1531 8.8 HIGH Cisco Modeling Labs Web UI Command Injection Vulnerability
CVE-2021-1559 6.5 MEDIUM Cisco DNA Spaces Connector Command Injection Vulnerabilities
CVE-2021-1560 6.5 MEDIUM Cisco DNA Spaces Connector Command Injection Vulnerabilities
CVE-2021-1558 6.0 MEDIUM Cisco DNA Spaces Connector Privilege Escalation Vulnerabilities
CVE-2021-1557 6.0 MEDIUM Cisco DNA Spaces Connector Privilege Escalation Vulnerabilities
CVE-2021-1254 4.8 MEDIUM Cisco Finesse Cross-Site Scripting Vulnerabilities
CVE-2021-1549 4.7 MEDIUM Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul
CVE-2021-1548 4.7 MEDIUM Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul
CVE-2021-1358 4.7 MEDIUM Cisco Finesse Open Redirect Vulnerability
CVE-2021-1547 4.7 MEDIUM Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul
CVE-2021-1555 4.7 MEDIUM Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul
CVE-2021-1554 4.7 MEDIUM Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul
CVE-2021-1553 4.7 MEDIUM Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul
CVE-2021-1552 4.7 MEDIUM Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul
CVE-2021-1551 4.7 MEDIUM Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul
CVE-2021-1550 4.7 MEDIUM Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul

IV. Related Vulnerabilities

Same product: Cisco Identity Services Engine Software
Same vendor: Cisco
Same weakness: CWE-73

V. Comments for CVE-2021-1306

No comments yet

Leave a comment