==================================================================== CERT-Renater Note d'Information No. 2021/VULN035 _____________________________________________________________________ DATE : 21/01/2021 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Cisco SD-WAN software; Cisco DNA Center software; Cisco Smart Software Manager Satellite software; Cisco Advanced Malware Protection for Endpoints and Immunet for Windows software; Cisco Data Center Network Manager software; Cisco Data Center Network Manager software; Cisco Umbrella software; Cisco Web Security Appliance software; Cisco Email Security Appliance software; Cisco Unified Communications Products software; Cisco StarOS software; Cisco Elastic Services Controller software;. ===================================================================== https://tools.cisco.com/security/center/publicationListing.x _____________________________________________________________________ Below is the list of Cisco Security Advisories published by Cisco PSIRT on 2021-January-20. The following PSIRT security advisories (4 Critical, 9 High, 18 Medium) were published at 16:00 UTC today. Table of Contents: 1) Cisco SD-WAN Buffer Overflow Vulnerabilities - SIR: Critical 2) Cisco DNA Center Command Runner Command Injection Vulnerability - SIR: Critical 3) Cisco SD-WAN Command Injection Vulnerabilities - SIR: Critical 4) Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities - SIR: Critical 5) Cisco SD-WAN vManage Authorization Bypass Vulnerabilities - SIR: High 6) Cisco Advanced Malware Protection for Endpoints and Immunet for Windows DLL Hijacking Vulnerability - SIR: High 7) Cisco Data Center Network Manager Certificate Validation Vulnerabilities - SIR: High 8) Cisco SD-WAN Denial of Service Vulnerabilities - SIR: High 9) Cisco Data Center Network Manager Server-Side Request Forgery Vulnerability - SIR: High 10) Cisco Data Center Network Manager SQL Injection Vulnerabilities - SIR: High 11) Cisco Smart Software Manager Satellite Static Credential Vulnerability - SIR: High 12) Cisco DNA Center Information Disclosure Vulnerability - SIR: High 13) Cisco DNA Center Cross-Site Request Forgery Vulnerability - SIR: High 14) Cisco Umbrella Dashboard Packet Flood Vulnerability - SIR: Medium 15) Cisco Smart Software Manager Satellite SQL Injection Vulnerability - SIR: Medium 16) Cisco SD-WAN vManage Software Path Traversal Vulnerability - SIR: Medium 17) Cisco SD-WAN vManage Information Disclosure Vulnerability - SIR: Medium 18) Cisco Data Center Network Manager Vulnerabilities - SIR: Medium 19) Cisco DNA Center Privilege Escalation Vulnerability - SIR: Medium 20) Cisco SD-WAN Information Disclosure Vulnerability - SIR: Medium 21) Cisco Data Center Network Manager Authorization Bypass Vulnerabilities - SIR: Medium 22) Cisco Data Center Network Manager Information Disclosure Vulnerability - SIR: Medium 23) Cisco Data Center Network Manager REST API Vulnerabilities - SIR: Medium 24) Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability - SIR: Medium 25) Cisco SD-WAN vManage SQL Injection Vulnerabilities - SIR: Medium 26) Cisco Smart Software Manager Satellite Open Redirect Vulnerability - SIR: Medium 27) Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability - SIR: Medium 28) Cisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web Security Appliance Information Disclosure Vulnerability - SIR: Medium 29) Cisco Unified Communications Products Vulnerabilities - SIR: Medium 30) Cisco StarOS IPv4 Denial of Service Vulnerability - SIR: Medium 31) Cisco Elastic Services Controller Denial of Service Vulnerability - SIR: Medium +-------------------------------------------------------------------- 1) Cisco SD-WAN Buffer Overflow Vulnerabilities CVE-2021-1300, CVE-2021-1301 SIR: Critical CVSS Score v(3.0): 9.8 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-bufovulns-B5NrSHbj"] +-------------------------------------------------------------------- 2) Cisco DNA Center Command Runner Command Injection Vulnerability CVE-2021-1264 SIR: Critical CVSS Score v(3.1): 9.6 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-cmdinj-erumsWh9 ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-cmdinj-erumsWh9"] +-------------------------------------------------------------------- 3) Cisco SD-WAN Command Injection Vulnerabilities CVE-2021-1260, CVE-2021-1261, CVE-2021-1262, CVE-2021-1263, CVE-2021-1298, CVE-2021-1299 SIR: Critical CVSS Score v(3.1): 9.9 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-cmdinjm-9QMSmgcn"] +-------------------------------------------------------------------- 4) Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities CVE-2021-1138, CVE-2021-1139, CVE-2021-1140, CVE-2021-1141, CVE-2021-1142 SIR: Critical CVSS Score v(3.1): 9.8 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-multici-pgG5WM5A ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-multici-pgG5WM5A"] +-------------------------------------------------------------------- 5) Cisco SD-WAN vManage Authorization Bypass Vulnerabilities CVE-2021-1302, CVE-2021-1304, CVE-2021-1305 SIR: High CVSS Score v(3.1): 8.8 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-abyp-TnGFHrS ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-abyp-TnGFHrS"] +-------------------------------------------------------------------- 6) Cisco Advanced Malware Protection for Endpoints and Immunet for Windows DLL Hijacking Vulnerability CVE-2021-1280 SIR: High CVSS Score v(3.1): 7.8 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-amp-imm-dll-5PAZ3hRV ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-amp-imm-dll-5PAZ3hRV"] +-------------------------------------------------------------------- 7) Cisco Data Center Network Manager Certificate Validation Vulnerabilities CVE-2021-1276, CVE-2021-1277 SIR: High CVSS Score v(3.1): 7.5 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-cert-check-BdZZV9T3 ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-cert-check-BdZZV9T3"] +-------------------------------------------------------------------- 8) Cisco SD-WAN Denial of Service Vulnerabilities CVE-2021-1241, CVE-2021-1273, CVE-2021-1274, CVE-2021-1278, CVE-2021-1279 SIR: High CVSS Score v(3.1): 8.6 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-dosmulti-48jJuEUP"] +-------------------------------------------------------------------- 9) Cisco Data Center Network Manager Server-Side Request Forgery Vulnerability CVE-2021-1272 SIR: High CVSS Score v(3.1): 8.8 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-ssrf-F2vX6q5p ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-ssrf-F2vX6q5p"] +-------------------------------------------------------------------- 10) Cisco Data Center Network Manager SQL Injection Vulnerabilities CVE-2021-1247, CVE-2021-1248 SIR: High CVSS Score v(3.1): 8.8 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-sql-inj-OAQOObP ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-sql-inj-OAQOObP"] +-------------------------------------------------------------------- 11) Cisco Smart Software Manager Satellite Static Credential Vulnerability CVE-2021-1219 SIR: High CVSS Score v(3.0): 7.8 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-sc-Jd42D4Tq ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-sc-Jd42D4Tq"] +-------------------------------------------------------------------- 12) Cisco DNA Center Information Disclosure Vulnerability CVE-2021-1265 SIR: High CVSS Score v(3.0): 7.7 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnacid-OfeeRjcn ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnacid-OfeeRjcn"] +-------------------------------------------------------------------- 13) Cisco DNA Center Cross-Site Request Forgery Vulnerability CVE-2021-1265 SIR: High CVSS Score v(3.0): 7.1 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-csrf-dC83cMcV ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-csrf-dC83cMcV"] +-------------------------------------------------------------------- 14) Cisco Umbrella Dashboard Packet Flood Vulnerability CVE-2021-1350 SIR: Medium CVSS Score v(3.1): 5.3 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umb-dos-dgKzDEBP ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umb-dos-dgKzDEBP"] +-------------------------------------------------------------------- 15) Cisco Smart Software Manager Satellite SQL Injection Vulnerability CVE-2021-1222 SIR: Medium CVSS Score v(3.0): 6.8 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-sqi-h5fDvZWp ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-sqi-h5fDvZWp"] +-------------------------------------------------------------------- 16) Cisco SD-WAN vManage Software Path Traversal Vulnerability CVE-2021-1259 SIR: Medium CVSS Score v(3.0): 5.3 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-pathtrav-Z5mCVsjf ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-pathtrav-Z5mCVsjf"] +-------------------------------------------------------------------- 17) Cisco SD-WAN vManage Information Disclosure Vulnerability CVE-2021-1235 SIR: Medium CVSS Score v(3.0): 5.5 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vinfdis-MC8L58dj ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vinfdis-MC8L58dj"] +-------------------------------------------------------------------- 18) Cisco Data Center Network Manager Vulnerabilities CVE-2021-1249, CVE-2021-1250, CVE-2021-1253, CVE-2021-1286 SIR: Medium CVSS Score v(3.1): 6.5 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-xss-vulns-GuUJ39gh ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-xss-vulns-GuUJ39gh"] +-------------------------------------------------------------------- 19) Cisco DNA Center Privilege Escalation Vulnerability CVE-2021-1303 SIR: Medium CVSS Score v(3.0): 4.3 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-privesc-6qjA3hVh ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-privesc-6qjA3hVh"] +-------------------------------------------------------------------- 20) Cisco SD-WAN Information Disclosure Vulnerability CVE-2021-1233 SIR: Medium CVSS Score v(3.0): 4.4 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-infodis-2-UPO232DG ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-infodis-2-UPO232DG"] +-------------------------------------------------------------------- 21) Cisco Data Center Network Manager Authorization Bypass Vulnerabilities CVE-2021-1269, CVE-2020-1270 SIR: Medium CVSS Score v(3.1): 7.1 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-authbypass-OHBPbxu ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-authbypass-OHBPbxu"] +-------------------------------------------------------------------- 22) Cisco Data Center Network Manager Information Disclosure Vulnerability CVE-2021-1283 SIR: Medium CVSS Score v(3.1): 5.5 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-info-disc-QCSJB6YG ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-info-disc-QCSJB6YG"] +-------------------------------------------------------------------- 23) Cisco Data Center Network Manager REST API Vulnerabilities CVE-2021-1133, CVE-2021-1135, CVE-2021-1255 SIR: Medium CVSS Score v(3.0): 6.5 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-api-path-TpTApx2p ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-api-path-TpTApx2p"] +-------------------------------------------------------------------- 24) Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability CVE-2021-1349 SIR: Medium CVSS Score v(3.1): 6.5 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-cql-inject-72EhnUc ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-cql-inject-72EhnUc"] +-------------------------------------------------------------------- 25) Cisco SD-WAN vManage SQL Injection Vulnerabilities CVE-2021-1225 SIR: Medium CVSS Score v(3.0): 6.5 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-sqlinjm-xV8dsjq5 ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-sqlinjm-xV8dsjq5"] +-------------------------------------------------------------------- 26) Cisco Smart Software Manager Satellite Open Redirect Vulnerability CVE-2021-1218 SIR: Medium CVSS Score v(3.0): 4.6 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssmor-MDCWkT2x ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssmor-MDCWkT2x"] +-------------------------------------------------------------------- 27) Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability CVE-2021-1271 SIR: Medium CVSS Score v(3.1): 4.8 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-xss-RuB5WGqL ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-xss-RuB5WGqL"] +-------------------------------------------------------------------- 28) Cisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web Security Appliance Information Disclosure Vulnerability CVE-2021-1129 SIR: Medium CVSS Score v(3.1): 5.3 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-wsa-sma-info-RHp44vAC ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-wsa-sma-info-RHp44vAC"] +-------------------------------------------------------------------- 29) Cisco Unified Communications Products Vulnerabilities CVE-2021-1282, CVE-2021-1355, CVE-2021-1357, CVE-2021-1364 SIR: Medium CVSS Score v(3.1): 6.5 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-trav-inj-dM687ZD6 ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-trav-inj-dM687ZD6"] +-------------------------------------------------------------------- 30) Cisco StarOS IPv4 Denial of Service Vulnerability CVE-2021-1353 SIR: Medium CVSS Score v(3.1): 5.8 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr-mem-leak-dos-MTWGHKk3 ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr-mem-leak-dos-MTWGHKk3"] +-------------------------------------------------------------------- 31) Cisco Elastic Services Controller Denial of Service Vulnerability CVE-2021-1312 SIR: Medium CVSS Score v(3.1): 5.3 URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esc-dos-4Gw6D527 ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esc-dos-4Gw6D527"] ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================