Vulnerability · Published Jun 4, 2021 · Assigned by cisco

CVE-2021-1537Cisco ThousandEyes Recorder Information Disclosure Vulnerability

Medium 6.2

In plain English

A medium-severity security flaw in Cisco ThousandEyes Recorder Application from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)6.2Medium

Exploit odds (30 days)0.2%top 89.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the installer software of Cisco ThousandEyes Recorder could allow an unauthenticated, local attacker to access sensitive information that is contained in the ThousandEyes Recorder installer software. This vulnerability exists because sensitive information is included in the application installer. An attacker could exploit this vulnerability by downloading the installer and extracting its contents. A successful exploit could allow the attacker to access sensitive information that is included in the application installer.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco ThousandEyes Recorder Application	n/a

Weakness: CWE-522 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

20210602 Cisco ThousandEyes Recorder Information Disclosure Vulnerability vendor-advisory, x_refsource_CISCO