CVE-2021-1531— Cisco Modeling Labs Web UI Command Injection Vulnerability
Quick assessment
Affected
Cisco Cisco Modeling Labs
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco Modeling Labs是美国思科（Cisco）公司的一个应用软件。一个在工作站和服务器上运行的本地网络模拟工具。 Cisco Modeling Labs 存在参数注入漏洞，该漏洞源于对用户提供的web UI输入的验证不足，攻击者可利用该漏洞在底层操作系统上执行任意命令。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-1531
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Modeling Labs Web UI Command Injection Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the web UI of Cisco Modeling Labs could allow an authenticated, remote attacker to execute arbitrary commands with the privileges of the web application on the underlying operating system of an affected Cisco Modeling Labs server. This vulnerability is due to insufficient validation of user-supplied input to the web UI. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected server. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the web application, virl2, on the underlying operating system of the affected server. To exploit this vulnerability, the attacker must have valid user credentials on the web UI.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco Modeling Labs 参数注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Modeling Labs是美国思科（Cisco）公司的一个应用软件。一个在工作站和服务器上运行的本地网络模拟工具。 Cisco Modeling Labs 存在参数注入漏洞，该漏洞源于对用户提供的web UI输入的验证不足，攻击者可利用该漏洞在底层操作系统上执行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Modeling Labs | n/a | - |
|
II. Public POCs for CVE-2021-1531
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-1531
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-1531 (1)
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cml-cmd-inject-N4VYeQXB vendor-advisory x_refsource_CISCO
Exploits & Public PoCs for CVE-2021-1531 (1)
Same Patch Batch · Cisco · 2021-05-22 · 18 CVEs total
| CVE-2021-1487 | 8.8 HIGH | Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Command Injectio |
| CVE-2021-1559 | 6.5 MEDIUM | Cisco DNA Spaces Connector Command Injection Vulnerabilities |
| CVE-2021-1560 | 6.5 MEDIUM | Cisco DNA Spaces Connector Command Injection Vulnerabilities |
| CVE-2021-1557 | 6.0 MEDIUM | Cisco DNA Spaces Connector Privilege Escalation Vulnerabilities |
| CVE-2021-1558 | 6.0 MEDIUM | Cisco DNA Spaces Connector Privilege Escalation Vulnerabilities |
| CVE-2021-1254 | 4.8 MEDIUM | Cisco Finesse Cross-Site Scripting Vulnerabilities |
| CVE-2021-1549 | 4.7 MEDIUM | Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul |
| CVE-2021-1548 | 4.7 MEDIUM | Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul |
| CVE-2021-1547 | 4.7 MEDIUM | Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul |
| CVE-2021-1358 | 4.7 MEDIUM | Cisco Finesse Open Redirect Vulnerability |
| CVE-2021-1555 | 4.7 MEDIUM | Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul |
| CVE-2021-1554 | 4.7 MEDIUM | Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul |
| CVE-2021-1553 | 4.7 MEDIUM | Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul |
| CVE-2021-1552 | 4.7 MEDIUM | Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul |
| CVE-2021-1551 | 4.7 MEDIUM | Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul |
| CVE-2021-1550 | 4.7 MEDIUM | Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vul |
| CVE-2021-1306 | 4.4 MEDIUM | Cisco ADE-OS Local File Inclusion Vulnerability |
IV. Related Vulnerabilities
Same vendor: Cisco
-
CVE-2026-76504
Cisco Catalyst SD-WAN Manager System Account Authorization B -
CVE-2026-76426
Cisco ISE REST API SQL Injection Vulnerability -
CVE-2026-20121
CIsco FTD Bypass Access List -
CVE-2026-76431
Cisco Identity Services Engine Arbitrary File Deletion Vulne -
CVE-2026-76427
Cisco ISE XML External Entity Injection Vulnerability
Same weakness: CWE-88
-
CVE-2026-91784
Argument Injection leading to arbitrary process termination -
CVE-2026-97662
Argument injection in the diff scan operation in AWS securit -
CVE-2026-103505
AWS EFS CSI Driver Mount Option Injection via mounttargetipm -
CVE-2026-102904
JupyterLab: Argument injection in JupyterLab extension unins -
CVE-2026-100714
Froxlor before 2.3.12 Command Injection via letsencryptchall
V. Comments for CVE-2021-1531
No comments yet