{"id":"CVE-2021-34721","state":"PUBLISHED","title":"Cisco IOS XR Software Command Injection Vulnerabilities","description":"Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory.","publishedAt":"2021-09-09T05:01:13.579Z","updatedAt":"2024-11-07T22:00:42.833Z","severity":{"score":6.7,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"cisco"},"assigner":"cisco","products":["Cisco Cisco IOS XR Software"],"affected":[{"vendor":"Cisco","product":"Cisco IOS XR Software","versions":[{"version":"n/a","status":"affected"}]}],"references":["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T19:48:38.863Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/34xxx/CVE-2021-34721.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-34721","state":"PUBLISHED","datePublished":"2021-09-09T05:01:13.579Z","dateUpdated":"2024-11-07T22:00:42.833Z","assignerShortName":"cisco","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateReserved":"2021-06-15T00:00:00.000Z"},"containers":{"cna":{"title":"Cisco IOS XR Software Command Injection Vulnerabilities","descriptions":[{"lang":"en","value":"Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory."}],"affected":[{"vendor":"Cisco","product":"Cisco IOS XR Software","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc","name":"20210908 Cisco IOS XR Software Command Injection Vulnerabilities","tags":["vendor-advisory","x_refsource_CISCO"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cisco","dateUpdated":"2021-09-09T05:01:13.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633"},"datePublic":"2021-09-08T00:00:00.000Z","exploits":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}],"source":{"advisory":"cisco-sa-iosxr-cmd-inj-wbZKvPxc","defect":[["CSCvx48001","CSCvx48002"]],"discovery":"INTERNAL"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","DATE_PUBLIC":"2021-09-08T16:00:00","ID":"CVE-2021-34721","STATE":"PUBLIC","TITLE":"Cisco IOS XR Software Command Injection Vulnerabilities"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Cisco IOS XR Software","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"Cisco"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory."}]},"exploit":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}],"impact":{"cvss":{"baseScore":"6.7","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-78"}]}]},"references":{"reference_data":[{"name":"20210908 Cisco IOS XR Software Command Injection Vulnerabilities","refsource":"CISCO","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc"}]},"source":{"advisory":"cisco-sa-iosxr-cmd-inj-wbZKvPxc","defect":[["CSCvx48001","CSCvx48002"]],"discovery":"INTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc","name":"20210908 Cisco IOS XR Software Command Injection Vulnerabilities","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T00:19:48.110Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-07T21:43:12.552835Z","id":"CVE-2021-34721","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-07T22:00:42.833Z"}}]}}}