Vulnerability · Published Jan 20, 2021 · Assigned by cisco
CVE-2021-1139Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities
Critical 9.8
In plain English
A critical-severity improper input validation in Cisco Smart Software Manager On-Prem from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.0% (higher than 91% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)4.0%top 9.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Smart Software Manager On-Prem | n/a |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- 20210120 Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities vendor-advisory, x_refsource_CISCO