© 2026 vulntracker.io

CVE-2021-1392

Cisco IOS and IOS XE Software Common Industrial Protocol Privilege Escalation Vulnerability

HIGH

7.8

CVSS Score

Published: March 24, 2021 at 08:07 PM UTC

Updated: June 17, 2026 at 03:31 AM UTC

2 products affected across 1 vendorIOSIOS Xe

Using Cisco IOS by Cisco?

Get instant alerts when new vulnerabilities affect Cisco IOS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

A vulnerability in the CLI command permissions of Cisco IOS and Cisco IOS XE Software could allow an authenticated, local attacker to retrieve the password for Common Industrial Protocol (CIP) and then remotely configure the device as an administrative user. This vulnerability exists because incorrect permissions are associated with the show cip security CLI command. An attacker could exploit this vulnerability by issuing the command to retrieve the password for CIP on an affected device. A successful exploit could allow the attacker to reconfigure the device.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

IOS · Cisconpm

95%

15.0(1)ey 15.0(1)ey1 15.0(1)ey2 15.1(3)svs 15.1(3)svt1 15.2(1)ey 15.2(2)e 15.2(2)e1 15.2(2)e10 15.2(2)e2 15.2(2)e3 15.2(2)e4 15.2(2)e5 15.2(2)e5a 15.2(2)e5b 15.2(2)e6 15.2(2)e7 15.2(2)e7b 15.2(2)e8 15.2(2)e9 15.2(2)ea 15.2(2)ea1 15.2(2)ea2 15.2(2)ea3 15.2(2)eb 15.2(2)eb1 15.2(2)eb2 15.2(2a)e2 15.2(2b)e 15.2(3)e1 15.2(3)e2 15.2(3)e3 15.2(3)e4 15.2(3)e5 15.2(3)ea 15.2(4)e5a 15.2(4)ea 15.2(4)ea115.2(4)ea1015.2(4)ea2 15.2(4)ea3 15.2(4)ea4 15.2(4)ea5 15.2(4)ea6 15.2(4)ea7 15.2(4)ea8 15.2(4)ea9 15.2(4)ea9a 15.2(4)ec1 15.2(4)ec2 15.2(4)jaz 15.2(5)e 15.2(5)e115.2(5)e215.2(5)e2b 15.2(5)e2c 15.2(5)ea 15.2(5a)e1 15.2(6)e 15.2(6)e0a15.2(6)e0c15.2(6)e1 15.2(6)e1a 15.2(6)e1s 15.2(7)e0b15.2(7a)e0b15.2(7b)e0b15.3(3)ja1 15.3(3)ja10 15.3(3)ja11 15.3(3)ja12 15.3(3)ja4 15.3(3)ja5 15.3(3)ja6 15.3(3)ja7 15.3(3)ja8 15.3(3)jaa 15.3(3)jax 15.3(3)jax1 15.3(3)jax2 15.3(3)jb 15.3(3)jbb 15.3(3)jbb1 15.3(3)jbb2 15.3(3)jbb4 15.3(3)jbb5 15.3(3)jbb6 15.3(3)jbb6a 15.3(3)jbb8 15.3(3)jc 15.3(3)jc1 15.3(3)jc14 15.3(3)jc2 15.3(3)jc3 15.3(3)jc4 15.3(3)jc5 15.3(3)jc6 15.3(3)jc8 15.3(3)jc9 15.3(3)jd 15.3(3)jd11 15.3(3)jd12 15.3(3)jd13 15.3(3)jd14 15.3(3)jd16 15.3(3)jd17 15.3(3)jd2 15.3(3)jd3 15.3(3)jd4 15.3(3)jd5 15.3(3)jd6 15.3(3)jd7 15.3(3)jd8 15.3(3)jd9 15.3(3)je 15.3(3)jf 15.3(3)jf1 15.3(3)jf10 15.3(3)jf11 15.3(3)jf12 15.3(3)jf12i 15.3(3)jf13 15.3(3)jf2 15.3(3)jf4 15.3(3)jf5 15.3(3)jf6 15.3(3)jf7 15.3(3)jf8 15.3(3)jf9 15.3(3)jg 15.3(3)jg1 15.3(3)jh 15.3(3)jh1 15.3(3)ji1 15.3(3)ji3 15.3(3)ji4 15.3(3)ji5 15.3(3)ji6 15.3(3)jj 15.3(3)jj1 15.3(3)jk 15.3(3)jk1 15.3(3)jk1t 15.3(3)jk2 15.3(3)jk2a 15.3(3)jk3 15.3(3)jk4 15.3(3)jn 15.3(3)jn11 15.3(3)jn13 15.3(3)jn14 15.3(3)jn15 15.3(3)jn3 15.3(3)jn4 15.3(3)jn6 15.3(3)jn7 15.3(3)jn8 15.3(3)jn9 15.3(3)jnb 15.3(3)jnb1 15.3(3)jnb2 15.3(3)jnb3 15.3(3)jnb4 15.3(3)jnb5 15.3(3)jnb6 15.3(3)jnc 15.3(3)jnc1 15.3(3)jnc2 15.3(3)jnc3 15.3(3)jnc4 15.3(3)jnd 15.3(3)jnd1 15.3(3)jnd2 15.3(3)jnd3 15.3(3)jnp 15.3(3)jnp1 15.3(3)jnp3 15.3(3)jpb 15.3(3)jpb1 15.3(3)jpc 15.3(3)jpc1 15.3(3)jpc2 15.3(3)jpc315.3(3)jpc515.3(3)jpd

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-SAP-OPLbze68

References (1)

Vendor Advisoryx_refsource_CISCO

Source: [email protected]

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-SAP-OPLbze68

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHcisco

Attack Vector: LOCAL
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-522

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card