Security readout for executives and security teams
Plain-English summary
This flaw could let someone with valid device credentials read files they should not access on affected Cisco ASR 5000 Series routers running StarOS. It is not described as unauthenticated or publicly exploited, but it matters because routers may contain sensitive configuration, credentials, and operational data.
Executive priority
Treat as a confidentiality risk on critical network infrastructure. Prioritize review where ASR 5000 devices support sensitive carrier or enterprise services, or where management credentials may be shared, stale, or exposed.
Technical view
CVE-2021-1145 is an authenticated remote arbitrary file read in Cisco StarOS SFTP handling for Cisco ASR 5000 Series Software. The issue is linked to insecure symbolic-link handling, classified as CWE-61, with CVSS 3.1 score 6.5 and high confidentiality impact only.
Likely exposure
Exposure is likely limited to organizations running affected Cisco ASR 5000 Series Software where authenticated users can reach SFTP on the device. The provided sources do not identify exact affected versions or deployment prerequisites beyond valid credentials and affected device software.
Exploitation context
The source bundle does not indicate CISA KEV listing or active exploitation. Exploitation requires valid credentials and a crafted SFTP command, so insider misuse, compromised admin accounts, or over-broad operational access are the main concern areas.
Researcher notes
Evidence supports arbitrary file read through SFTP symbolic-link handling with low attack complexity and required low privileges. The bundle does not provide fixed versions, workaround names, exploit maturity, or proof of public exploitation, so avoid asserting more than the Cisco advisory and CVE data state.
Mitigation direction
- Check Cisco’s advisory for affected and fixed release guidance.
- Apply vendor-recommended updates or mitigations where applicable.
- Limit SFTP and management-plane access to trusted administration networks.
- Remove unnecessary device accounts and enforce least-privilege access.
- Monitor device access logs for unusual SFTP activity.
Validation and detection
- Inventory Cisco ASR 5000 Series devices and StarOS software exposure.
- Confirm affected status against the Cisco advisory.
- Review who has valid credentials for device SFTP access.
- Check whether SFTP is reachable from untrusted networks.
- Review logs for unexpected authenticated SFTP sessions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-61: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-1145 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- 20210113 Cisco StarOS for Cisco ASR 5000 Series Routers Arbitrary File Read VulnerabilityCVE reference · vendor-advisory, x_refsource_CISCO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
UNIX Symbolic Link (Symlink) Following
UNIX Symbolic Link (Symlink) Following represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.