CVE-2021-1522

Cisco Connected Mobile Experiences Strong Authentication Requirements Enforcement Bypass

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own password to a value that does not comply with the strong authentication requirements that are configured on an affected device. This vulnerability exists because a password policy check is incomplete at the time a password is changed at server side using the API. An attacker could exploit this vulnerability by sending a specially crafted API request to the affected device. A successful exploit could allow the attacker to change their own password to a value that does not comply with the configured strong authentication requirements.

Una vulnerabilidad en la API de cambio de contraseña de Cisco Connected Mobile Experiences (CMX), podría permitir a un atacante remoto autenticado alterar su propia contraseña a un valor que no cumpla con los requisitos de autenticación fuerte que están configurados en un dispositivo afectado. Esta vulnerabilidad se presenta porque una comprobación de la política de contraseñas está incompleta en el momento en que se cambia una contraseña en el lado del servidor usando la API. Un atacante podría explotar esta vulnerabilidad mediante el envío de una petición API especialmente diseñada al dispositivo afectado. Una explotación con éxito podría permitir al atacante cambiar su propia contraseña a un valor que no cumpla con los requisitos de autenticación fuerte configurados

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-11-13 CVE Reserved
2021-08-04 CVE Published
2023-03-08 EPSS Updated
2024-09-17 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-255: Credentials Management Errors
CWE-521: Weak Password Requirements

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmx-GkCvfd4	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"		Connected Mobile Experiences Search vendor "Cisco" for product "Connected Mobile Experiences"				10.6.0 Search vendor "Cisco" for product "Connected Mobile Experiences" and version "10.6.0"		-		Affected
Cisco Search vendor "Cisco"		Connected Mobile Experiences Search vendor "Cisco" for product "Connected Mobile Experiences"				10.6.1 Search vendor "Cisco" for product "Connected Mobile Experiences" and version "10.6.1"		-		Affected
Cisco Search vendor "Cisco"		Connected Mobile Experiences Search vendor "Cisco" for product "Connected Mobile Experiences"				10.6.2 Search vendor "Cisco" for product "Connected Mobile Experiences" and version "10.6.2"		-		Affected
Cisco Search vendor "Cisco"		Connected Mobile Experiences Search vendor "Cisco" for product "Connected Mobile Experiences"				10.6.3 Search vendor "Cisco" for product "Connected Mobile Experiences" and version "10.6.3"		-		Affected