LiveActive security incident?Get immediate response
CVE Record

CVE-2021-1349: Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the interface of an affected system. A successful exploit could allow the attacker to obtain sensitive information.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-1349 is an authenticated issue in Cisco SD-WAN vManage’s web management interface. A logged-in remote attacker could manipulate Cypher queries through crafted HTTP requests and potentially read sensitive information. It is not described as unauthenticated or destructive.

Executive priority

Treat as a priority for SD-WAN environments because sensitive network management data may be exposed. Urgency is reduced by the authentication requirement and lack of cited active exploitation evidence.

Technical view

Cisco reports insufficient input validation in the vManage web interface, enabling Cypher query language injection. CVSS 3.1 is 6.5: network reachable, low attack complexity, low privileges required, no user interaction, high confidentiality impact, no integrity or availability impact.

Likely exposure

Exposure is limited to organizations running Cisco SD-WAN vManage with reachable web-based management access and valid attacker credentials. The source bundle does not provide affected version ranges.

Exploitation context

The bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation requires authenticated access and crafted HTTP requests to the management interface.

Researcher notes

Key gaps are affected version details, fixed release information, and exploitation telemetry in the provided bundle. Validate exposure through asset inventory, version comparison, access review, and management-plane reachability checks.

Mitigation direction

  • Check Cisco’s advisory for affected and fixed vManage releases.
  • Apply Cisco-recommended updates or mitigations for the deployed version.
  • Restrict vManage web access to trusted admin networks or VPN.
  • Review and minimize low-privileged vManage user access.
  • Monitor vManage logs for unusual authenticated web requests.

Validation and detection

  • Inventory all Cisco SD-WAN vManage deployments.
  • Compare running versions against Cisco advisory guidance.
  • Confirm the web interface is not broadly internet-exposed.
  • Verify only required users have vManage access.
  • Review logs for suspicious authenticated data access patterns.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-943: Database access and collection lookup

Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-1349 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2021-1349Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
CiscoCisco SD-WAN vManagen/aListed
Weakness

CWE details

CWE-943

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-943 · source CWE mapping

Improper Neutralization of Special Elements in Data Query Logic

Improper Neutralization of Special Elements in Data Query Logic represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs