LiveActive security incident?Get immediate response
CVE Record

CVE-2021-1275: Cisco SD-WAN vManage Software Vulnerabilities

Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application. For more information about these vulnerabilities, see the Details section of this advisory.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

This is a critical Cisco SD-WAN vManage issue set. The worst case could let a remote unauthenticated attacker run code or access sensitive information, while other paths may allow privilege escalation. vManage controls SD-WAN operations, so exposure could affect core network management.

Executive priority

Handle as urgent where Cisco SD-WAN vManage is deployed, especially if reachable from untrusted networks. The business risk is compromise of a central WAN management platform, but remediation specifics require Cisco advisory confirmation.

Technical view

Cisco describes multiple Cisco SD-WAN vManage Software vulnerabilities tied to improper input validation. The supplied CVSS 3.1 score is 9.8 with network attack vector, low complexity, no privileges, no user interaction, and high confidentiality, integrity, and availability impact.

Likely exposure

Exposure applies to organizations running Cisco SD-WAN vManage. The source bundle does not specify affected or fixed versions, so version confirmation must come from Cisco’s advisory and local asset inventory.

Exploitation context

The provided sources do not state active exploitation, and the CVE is not marked CISA KEV. Treat exploit status as unconfirmed, not absent.

Researcher notes

The source bundle supports critical severity, CWE-20, and high-impact remote unauthenticated risk. It does not provide individual bug details, exploit availability, affected version ranges, or named patches beyond the Cisco advisory reference.

Mitigation direction

  • Identify all Cisco SD-WAN vManage deployments and versions.
  • Review Cisco’s advisory for affected and fixed release guidance.
  • Prioritize remediation for internet-accessible vManage systems.
  • Restrict vManage access to trusted administrative networks.
  • Increase monitoring of vManage administrative and API activity.

Validation and detection

  • Confirm deployed vManage versions against Cisco’s advisory.
  • Check whether vManage management interfaces are externally reachable.
  • Verify Cisco-recommended fixed releases are installed where applicable.
  • Review logs for unexpected administrative or API activity.
  • Validate access controls for local and remote administrators.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-20: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-1275 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2021-1275Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
CiscoCisco SD-WAN vManagen/aListed
Weakness

CWE details

CWE-20

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.