CVE-2021-1461

MEDIUM Year: 2021
CVSS v3 Score
4.9
Medium
Weakness Type
CWE-347
View all →

Vulnerability Description

A vulnerability in the Image Signature Verification feature of Cisco SD-WAN Software could allow an authenticated, remote attacker with Administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by crafting an unsigned software patch to bypass signature checks and loading it on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image.Cisco has released software updates that address the vulnerability described in this advisory. There are no workarounds that address this vulnerability.

Related Vulnerabilities

CVE-2020-3308

MEDIUM
CVSS:4.9(Medium)

A vulnerability in the Image Signature Verification feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with administrator-level credentials to insta...

CWE-3472020

CVE-2016-8021

MEDIUM
CVSS:5.0(Medium)

Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to spoof update server and exec...

CWE-3472016

CVE-2017-18407

MEDIUM
CVSS:4.8(Medium)

cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).

CWE-3472017

CVE-2024-48948

MEDIUM
CVSS:4.8(Medium)

The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the ellipti...

CWE-3472024

CVE-2021-3521

MEDIUM
CVSS:4.7(Medium)

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing th...

CWE-3472021

CVE-2023-36811

MEDIUM
CVSS:4.7(Medium)

borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives ...

CWE-3472023