A vulnerability in the CLI command permissions of Cisco IOS and Cisco IOS XE Software could allow an authenticated, local attacker to retrieve the password for Common Industrial Protocol (CIP) and then remotely configure the device as an administrative user. This vulnerability exists because incorrect permissions are associated with the show cip security CLI command. An attacker could exploit this vulnerability by issuing the command to retrieve the password for CIP on an affected device. A successful exploit could allow the attacker to reconfigure the device.
Metrics
No CVSS v4.0
Attack Vector Local
Attack Complexity Low
Privileges Required Low
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
User Interaction None
No CVSS v3.0
Access Vector Local
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact None
Availability Impact None
AV:L/AC:L/Au:N/C:P/I:N/A:N
This CVE is not in the KEV list.
Exploitation none
Automatable no
Technical Impact total
Affected Vendors & Products
Vendors | Products |
---|---|
Cisco |
|
Configuration 1 [-]
|
No data.
References
History
Sat, 09 Nov 2024 00:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: cisco
Published: 2021-03-24T20:07:19.109626Z
Updated: 2024-11-08T23:33:05.994Z
Reserved: 2020-11-13T00:00:00
Link: CVE-2021-1392
Vulnrichment
Updated: 2024-08-03T16:11:16.883Z
NVD
Status : Modified
Published: 2021-03-24T20:15:14.057
Modified: 2024-11-21T05:44:14.933
Link: CVE-2021-1392
Redhat
No data.