CVE-2021-34726

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system of an affected device. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to an affected device and submitting crafted input to the CLI. The attacker must be authenticated as an administrative user to execute the affected commands. A successful exploit could allow the attacker to execute commands with root-level privileges.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-347279.8A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a buffer oveCVE-2021-347287.8Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker with a low-privileged account to eCVE-2021-347296.7A vulnerability in the CLI of Cisco IOS XE SD-WAN Software and Cisco IOS XE Software could allow an authenticated, local attacker to executeCVE-2021-34734.9An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be CVE-2021-347309.8A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow CVE-2021-347314.8A vulnerability in the web-based management interface of Cisco Prime Access Registrar could allow an authenticated, remote attacker to perfoCVE-2021-347326.1A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacCVE-2021-347335.5A vulnerability in the CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, CVE-2021-347346.5A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for the Cisco Video Surveillance 7000 Series IP Cameras firmware CVE-2021-347357.5Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injectioCVE-2021-347367.5A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticateCVE-2021-347377.5A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to tr
CVE-2021-34726: Medium severity, CVSS 6.7 | Vulnix