CVE-2021-1522— Cisco Connected Mobile Experiences Strong Authentication Requirements Enforcement Bypass
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-1522
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Connected Mobile Experiences Strong Authentication Requirements Enforcement Bypass
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own password to a value that does not comply with the strong authentication requirements that are configured on an affected device. This vulnerability exists because a password policy check is incomplete at the time a password is changed at server side using the API. An attacker could exploit this vulnerability by sending a specially crafted API request to the affected device. A successful exploit could allow the attacker to change their own password to a value that does not comply with the configured strong authentication requirements.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
凭证管理
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco Connected Mobile Experiences 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Connected Mobile Experiences是美国思科（Cisco）公司的一个互联移动体验。 Cisco Connected Mobile Experiences(CMX)存在信任管理问题漏洞，该漏洞源于软件更改密码接口的问题。在使用该接口在服务器端更改密码时，密码策略检查不完整。经过身份验证的远程攻击者可以通过向受影响的设备发送一个特别制作的更改密码请求来利用漏洞，将自己的密码更改为不符合配置的强认证要求的值。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Connected Mobile Experiences | n/a | - |
II. Public POCs for CVE-2021-1522
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-1522
请登录查看更多情报信息。
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmx-GkCvfd4vendor-advisoryx_refsource_CISCO
- https://nvd.nist.gov/vuln/detail/CVE-2021-1522
Same Patch Batch · Cisco · 2021-08-04 · 7 CVEs total
| CVE-2021-1610 | 9.8 CRITICAL | Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Web Management Vulnera |
| CVE-2021-1609 | 9.8 CRITICAL | Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Web Management Vulnera |
| CVE-2021-1602 | 8.2 HIGH | Cisco Small Business RV160 and RV260 Series VPN Routers Remote Command Execution Vulnerabi |
| CVE-2021-1572 | 7.8 HIGH | ConfD CLI Secure Shell Server Privilege Escalation Vulnerability |
| CVE-2021-1593 | 7.3 HIGH | Cisco Packet Tracer for Windows DLL Injection Vulnerability |
| CVE-2021-34707 | 6.5 MEDIUM | Cisco Evolved Programmable Network Manager Sensitive Information Disclosure Vulnerability |
IV. Related Vulnerabilities
Same product: Cisco Connected Mobile Experiences
- CVE-2021-1144
Cisco Connected Mobile Experiences Privilege Escalation Vuln - CVE-2021-1143
Cisco Connected Mobile Experiences User Enumeration Vulnerab - CVE-2020-3151
Cisco Connected Mobile Experiences Restricted Shell Escape V - CVE-2020-3152
Cisco Connected Mobile Experiences Privilege Escalation Vuln - CVE-2019-1645
Cisco Connected Mobile Experiences Information Disclosure Vu
Same vendor: Cisco
- CVE-2026-20219
Cisco Slido 安全漏洞 - CVE-2026-20034
Cisco Unity Connection Remote Code Execution Vulnerability - CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerabi - CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi
Same weakness: CWE-255
- CVE-2021-37000
Huawei HarmonyOS Wearables安全漏洞 - CVE-2021-28509
TerminAttr streams MACsec sensitive data in clear text to ot - CVE-2021-28508
TerminAttr streams IPsec sensitive data in clear text to oth - CVE-2022-25327
Local Denial of Service in fscrypt PAM module - CVE-2020-8968
Parallels Remote Application Server credentials management e
V. Comments for CVE-2021-1522
No comments yet