Medium severity · published Nov 15, 2024
CVE-2021-1464
A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization checking and gain restricted access to the…
5.0
CVSS
1.3%
EPSS
No
On KEV
Description
A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization checking and gain restricted access to the configuration information of an affected system.
This vulnerability exists because the affected software has insufficient input validation for certain commands. An attacker could exploit this vulnerability by sending crafted requests to the affected commands of an affected system. A successful exploit could allow the attacker to bypass authorization checking and gain restricted access to the configuration data of the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Catalyst Sd-wan Manager · Cisco
17.2.4; 17.2.5; 17.2.6; 17.2.7; 17.2.8; 17.2.9; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-1464
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-1464
Not Applicable
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdw-sqlinj-HDJUeEAX
Not Applicable
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vdaemon-bo-RuzzEA2
Not Applicable
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-auth-bypass-Z3Zze5XC
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-authorization-b-GUEpSLK
Not Applicable
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-cmdinj-nRHKgfHX
Not Applicable
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-dir-trav-Bpwc5gtm
More from Catalyst Sd-wan Manager
10.0
CVE-2026-20182
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
10.0
CVE-2026-20127
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
9.8
CVE-2026-76504
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
7.8
CVE-2026-20245
Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability
7.8
CVE-2022-20775
Cisco SD-WAN Software Privilege Escalation Vulnerability
