Vulnerabilities > CVE-2021-1540 - Incorrect Authorization vulnerability in Cisco Staros

CVSS 7.2 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

cisco

CWE-863

NVD

Published: 2021-06-04

Updated: 2023-11-07

Summary

Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an authenticated, remote attacker to bypass authorization and execute a subset of CLI commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco Staros - Cisco Staros 11.0_Base Cisco Staros 12.0 Cisco Staros 12.0.0 Cisco Staros 12.1_Base Cisco Staros 12.2\(300\) Cisco Staros 12.2_Base Cisco Staros 14.0\(600\) Cisco Staros 14.0.0 Cisco Staros 15.0\(912\) Cisco Staros 15.0\(935\) Cisco Staros 15.0\(938\) Cisco Staros 15.0_Base Cisco Staros 16.0\(900\) Cisco Staros 16.0.0 Cisco Staros 16.1.0 Cisco Staros 16.1.1 Cisco Staros 16.1.2 Cisco Staros 16.5.0 Cisco Staros 16.5.2 Cisco Staros 17.2.0 Cisco Staros 17.2.0.59184 Cisco Staros 17.3.0 Cisco Staros 17.3.1 Cisco Staros 17.3_Base Cisco Staros 17.7.0 Cisco Staros 18.0.0 Cisco Staros 18.0.0.57828 Cisco Staros 18.0.0.59167 Cisco Staros 18.0.0.59211 Cisco Staros 18.0.L0.59219 Cisco Staros 18.1.0 Cisco Staros 18.1.0.59776 Cisco Staros 18.1.0.59780 Cisco Staros 18.1_Base Cisco Staros 18.3.0 Cisco Staros 18.3_Base Cisco Staros 18.4.0 Cisco Staros 19.0.1 Cisco Staros 19.0.M0.60737 Cisco Staros 19.0.M0.60828 Cisco Staros 19.0.M0.61045 Cisco Staros 19.1.0 Cisco Staros 19.1.0.61559 Cisco Staros 19.2.0 Cisco Staros 19.3.0 Cisco Staros 19.4.2.65120 Cisco Staros 19.6.0 Cisco Staros 20.0.0 Cisco Staros 20.0.1.0 Cisco Staros 20.0.1.A0 Cisco Staros 20.0.1.V0 Cisco Staros 20.0.2.3 Cisco Staros 20.0.2.3.65026 Cisco Staros 20.0.2.V1 Cisco Staros 20.0.M0.62842 Cisco Staros 20.0.M0.63229 Cisco Staros 20.0.V0 Cisco Staros 21.0.0 Cisco Staros 21.0.V0.65819 Cisco Staros 21.0.V4 Cisco Staros 21.0_Base Cisco Staros 21.0_M0.64246 Cisco Staros 21.0_M0.64702 Cisco Staros 21.1.V6 Cisco Staros 21.2.0 Cisco Staros 21.2.3 Cisco Staros 21.2.6 Cisco Staros 21.3 Cisco Staros 21.3.0.67664 Cisco Staros 21.3.1 Cisco Staros 21.3.15 Cisco Staros 21.4 Cisco Staros 21.4.0 Cisco Staros 21.5 Cisco Staros 21.5.0 Cisco Staros 21.5.7 Cisco Staros 21.6 Cisco Staros 21.6.0 Cisco Staros 21.6.4 Cisco Staros 21.6.12 Cisco Staros 21.6.13 Cisco Staros 21.6B Cisco Staros 21.6B.13 Cisco Staros 21.6B.16 Cisco Staros 21.7 Cisco Staros 21.7.0 Cisco Staros 21.7.8 Cisco Staros 21.7.11 Cisco Staros 21.8 Cisco Staros 21.8.0 Cisco Staros 21.8.6 Cisco Staros 21.8.10 Cisco Staros 21.9 Cisco Staros 21.9.0 Cisco Staros 21.9.2 Cisco Staros 21.9.7 Cisco Staros 21.10 Cisco Staros 21.10.0 Cisco Staros 21.10.2 Cisco Staros 21.11 Cisco Staros 21.11.0 Cisco Staros 21.11.1 Cisco Staros 21.11.3 Cisco Staros 21.12 Cisco Staros 21.12.9 Cisco Staros 21.12.12 Cisco Staros 21.13.1 Cisco Staros 21.13.5 Cisco Staros 21.14.0 Cisco Staros 21.15.1 Cisco Staros 21.15.3 Cisco Staros 21.15.5 Cisco Staros 21.15.6 Cisco Staros 21.15.7 Cisco Staros 21.15.9 Cisco Staros 21.15.10 Cisco Staros 21.15.11 Cisco Staros 21.15.12 Cisco Staros 21.15.13 Cisco Staros 21.15.14 Cisco Staros 21.15.15 Cisco Staros 21.15.16 Cisco Staros 21.15.17 Cisco Staros 21.15.18 Cisco Staros 21.15.19 Cisco Staros 21.15.20 Cisco Staros 21.15.21 Cisco Staros 21.15.22 Cisco Staros 21.15.23 Cisco Staros 21.15.24 Cisco Staros 21.15.26 Cisco Staros 21.15.27 Cisco Staros 21.15.28 Cisco Staros 21.15.29 Cisco Staros 21.15.30 Cisco Staros 21.15.32 Cisco Staros 21.15.33 Cisco Staros 21.15.37 Cisco Staros 21.15.39 Cisco Staros 21.15.40 Cisco Staros 21.16.1 Cisco Staros 21.16.3 Cisco Staros 21.16.4 Cisco Staros 21.17.0 Cisco Staros 21.17.1 Cisco Staros 21.17.2 Cisco Staros 21.17.3 Cisco Staros 21.17.4 Cisco Staros 21.17.5 Cisco Staros 21.17.7 Cisco Staros 21.18.0 Cisco Staros 21.18.1 Cisco Staros 21.18.2 Cisco Staros 21.18.3 Cisco Staros 21.18.4 Cisco Staros 21.19.0 Cisco Staros 21.19.1 Cisco Staros 21.19.2 Cisco Staros 21.19.3 Cisco Staros 21.19.7 Cisco Staros 21.19.10 Cisco Staros 21.19.N Cisco Staros 21.19.N4 Cisco Staros 21.20.0 Cisco Staros 21.20.1 Cisco Staros 21.20.2 Cisco Staros 21.20.3 Cisco Staros 21.20.4 Cisco Staros 21.20.5 Cisco Staros 21.20.6 Cisco Staros 21.20.7	172
Hardware	Cisco Cisco ASR 5000 - Cisco ASR 5500 - Cisco ASR 5700 -	3
Application	Cisco Cisco Virtualized Packet Core -	1

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr5k-autho-bypass-mJDF5S7n