What is CVE-2021-1488?

CVE-2021-1488 is a medium-severity vulnerability in Cisco Adaptive_security_appliance_software, classified under Command Injection. CVSS score: 6.7/10. Published 2021-04-29.

How severe is CVE-2021-1488?

Medium severity. CVSS v3 base score is 6.7 out of 10.

RCE in Cisco Adaptive_security_appliance_software

CVE-2021-1488

A vulnerability in the upgrade process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject commands that could be executed with root p…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.003 (17.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cisco Adaptive_security_appliance_software
Cisco Adaptive Security Appliance (Asa) Software — versions n/a
Cisco Firepower_1010
Cisco Firepower_1120
Cisco Firepower_1140
Cisco Firepower_1150
Cisco Firepower_2110
Cisco Firepower_2120
Cisco Firepower_2130
Cisco Firepower_2140

Weakness classification (CWE)

CWE-77 — Command Injection
CWE-78 — OS Command Injection

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2021-1488?: CVE-2021-1488 is a medium-severity vulnerability in Cisco Adaptive_security_appliance_software, classified under Command Injection. CVSS score: 6.7/10. Published 2021-04-29.
How severe is CVE-2021-1488?: Medium severity. CVSS v3 base score is 6.7 out of 10.