Vulnerability in Image Signature Verification Feature Could Allow Attackers to Install Malware

CVE-2021-1461

Summary

A vulnerability exists in the Image Signature Verification feature of Cisco SD-WAN Software, enabling an authenticated remote attacker with Administrator-level credentials to exploit this flaw. The root cause of the issue is the improper verification of digital signatures for software patch images. This manipulation allows an attacker to create an unsigned software patch that can bypass the necessary signature checks, leading to the potential installation of a malicious software patch image on the affected device. As a result, successful exploitation could permit unauthorized actions on the system unless addressed through the software updates provided by Cisco, as there are no viable workarounds for this security flaw.

References