Unscored severity · published Jul 28, 2011
CVE-2011-2546
SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute…
–
CVSS
1.1%
EPSS
No
On KEV
Description
SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Sa500 Software · Cisco
through 2.1.18; 1.0.14; 1.0.15; 1.0.17; 1.0.39; 1.1.21; +2 more · source: NVD
SA
Sa520 · Cisco
All versions, or not specified · source: NVD
SA
Sa520w · Cisco
All versions, or not specified · source: NVD
SA
Sa540 · Cisco
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2546
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2546
Vendor Advisory
http://secunia.com/advisories/45355
securitytracker.com
http://securitytracker.com/id?1025810
Vendor Advisory
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b8915e.shtml
www.securityfocus.com
http://www.securityfocus.com/bid/48812
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/68737
More from Sa500 Software
–
CVE-2011-2547
The web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote authenticated users to execute arbitrary commands via…