LiveActive security incident?Get immediate response
CVE Record

CVE-2021-1484: Cisco SD-WAN vManage Command Injection Vulnerability

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to inject arbitrary commands on an affected system and cause a denial of service (DoS) condition. This vulnerability is due to improper input validation of user-supplied input to the device template configuration. An attacker could exploit this vulnerability by submitting crafted input to the device template configuration. A successful exploit could allow the attacker to cause a DoS condition on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Cisco SD-WAN vManage has an authenticated web UI command injection flaw that can crash or disrupt the affected system. The business risk is availability: SD-WAN management services may become unavailable if a low-privileged authenticated attacker submits malicious device template input.

Executive priority

Prioritize remediation for internet-exposed or broadly accessible vManage environments. The issue is not rated critical, but SD-WAN management availability is operationally important, and Cisco states there are no workarounds.

Technical view

CVE-2021-1484 is CWE-88 command injection in Cisco SD-WAN vManage device template configuration input validation. Cisco rates it CVSS 3.1 6.5: network-reachable, low complexity, low privileges, no user interaction, with high availability impact and no confidentiality or integrity impact stated.

Likely exposure

Exposure is likely limited to organizations running affected Cisco Catalyst SD-WAN Manager or Cisco SD-WAN vManage versions where authenticated users can access the web UI and device template configuration functions.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. Exploitation requires authenticated remote access and crafted input to device template configuration. Successful impact is described as denial of service, not data theft or system takeover.

Researcher notes

Do not assume broader impact than DoS from the provided sources. The bundle does not provide exploit evidence or fixed-version mapping, so validation should rely on Cisco advisory version guidance and local asset inventory.

Mitigation direction

  • Apply Cisco software updates that address this vulnerability.
  • Check Cisco advisory for the correct fixed release path.
  • Treat the issue as not workaroundable based on Cisco guidance.
  • Limit vManage web UI access to trusted administrative networks.
  • Review user permissions for device template configuration access.

Validation and detection

  • Inventory Cisco SD-WAN Manager or vManage versions against the affected list.
  • Confirm installed releases match Cisco fixed-release guidance.
  • Review access controls for authenticated web UI users.
  • Check change logs for unusual device template configuration activity.
  • Document residual exposure where upgrades are pending.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-88: Command execution behavior lookup

Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-1484 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/RL:X/RC:X/E:X

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/RL:X/RC:X/E:X2.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2021-1484Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/RL:X/RC:X/E:X

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
CiscoCisco Catalyst SD-WAN Manager20.1.12, 19.2.1, 18.4.4, 18.4.5, 20.1.1.1, 20.1.1, 19.3.0, 19.2.2, 19.2.099, 18.3.6, 18.3.7, 19.2.0, 18.3.8, 19.0.0, 19.1.0, 18.4.302, 18.4.303, 19.2.097, 19.2.098, 17.2.10, 18.3.6.1, 19.0.1a, 18.2.0, 18.4.3, 18.4.1, 17.2.8, 18.3.3.1, 18.4.0, 18.3.1, 17.2.6, 17.2.9, 18.3.4, 17.2.5, 18.3.1.1, 18.3.5, 18.4.0.1, 18.3.3, 17.2.7, 17.2.4, 18.3.0, 19.2.3, 18.4.501_ES, 20.3.1, 20.1.2, 19.2.929, 19.2.31, 20.3.2, 20.3.2.1, 20.3.2.1_927, 20.4.1, 20.3.2_928, 20.3.2_929, 20.4.1.0.1, 20.3.2.1_930, 19.2.4, 20.4.1.1, 20.3.3, 19.2.4.0.1unknown
Weakness

CWE details

CWE-88

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-88 · source CWE mapping

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs