CVE-2021-34724

Cisco IOS XE SD-WAN Software Privilege Escalation Vulnerability

MEDIUM

CVSS Score

Published: September 23, 2021 at 02:26 AM UTC

Updated: June 17, 2026 at 03:56 AM UTC

49 products affected across 1 vendorIOS Xe Sd WANAsr 1002-xAsr 1004

Using Cisco IOS XE SD-WAN Software by Cisco?

Get instant alerts when new vulnerabilities affect Cisco IOS XE SD-WAN Software - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to elevate privileges and execute arbitrary code on the underlying operating system as the root user. An attacker must be authenticated on an affected device as a PRIV15 user. This vulnerability is due to insufficient file system protection and the presence of a sensitive file in the bootflash directory on an affected device. An attacker could exploit this vulnerability by overwriting an installer file stored in the bootflash directory with arbitrary commands that can be executed with root-level privileges. A successful exploit could allow the attacker to read and write changes to the configuration database on the affected device.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

IOS Xe Sd WAN · Cisco

95%

v ≤ 17.3.1a

cisco-1000-integrated-services-router (environment) · cisco-1100-4g-6g-integrated-services-router (environment) · cisco-1100-4p-integrated-services-router (environment) · cisco-1100-8p-integrated-services-router (environment) · cisco-1100-integrated-services-router (environment) · cisco-1101-4p-integrated-services-router (environment) · cisco-1101-integrated-services-router (environment) · cisco-1109-2p-integrated-services-router (environment) · cisco-1109-4p-integrated-services-router (environment) · cisco-1109-integrated-services-router (environment) · cisco-1111x-8p-integrated-services-router (environment) · cisco-1111x-integrated-services-router (environment) · cisco-111x-integrated-services-router (environment) · cisco-1120-integrated-services-router (environment) · cisco-1160-integrated-services-router (environment) · cisco-4000-integrated-services-router (environment) · cisco-422-integrated-services-router (environment) · cisco-4221-integrated-services-router (environment) · cisco-4321-integrated-services-router (environment) · cisco-4331-integrated-services-router (environment) · cisco-4351-integrated-services-router (environment) · cisco-4431-integrated-services-router (environment) · cisco-4451-integrated-services-router (environment) · cisco-4451-x-integrated-services-router (environment) · cisco-4461-integrated-services-router (environment) · cisco-asr-1000 (environment) · cisco-asr-1000-esp100 (environment) · cisco-asr-1000-series (environment) · cisco-asr-1000-series-route-processor-rp2 (environment) · cisco-asr-1000-series-route-processor-rp3 (environment) · cisco-asr-1000-x (environment) · cisco-asr-1001 (environment) · cisco-asr-1001-hx (environment) · cisco-asr-1001-hx-r (environment) · cisco-asr-1001-x (environment) · cisco-asr-1001-x-r (environment) · cisco-asr-1002 (environment) · cisco-asr-1002-hx (environment) · cisco-asr-1002-hx-r (environment) · cisco-asr-1002-x (environment) · cisco-asr-1002-x-r (environment) · cisco-asr-1004 (environment) · cisco-asr-1006 (environment) · cisco-asr-1006-x (environment) · cisco-asr-1009-x (environment) · cisco-asr-1013 (environment) · cisco-asr-1023 (environment) · cisco-csr-1000v (environment)

1000 Integrated Services Router · Ciscodevice

80%

All versions

1100-4G/6G Integrated Services Router · Ciscodevice

80%

All versions

1100-4P Integrated Services Router · Ciscodevice

80%

All versions

1100-8P Integrated Services Router · Ciscodevice

80%

All versions