← Vulnerability feed

Vulnerability record · CVE-2021-34748 · published 6 October 2021

CVE-2021-34748: Cisco intersight virtual appliance command injection vulnerability

Cisco · Intersight Virtual Appliance

A vulnerability in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to perform a command injection attack on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using the web-based management interface to execute a command using crafted input. A successful exploit could allow the attacker to execute arbitrary commands using root-level privileges on an affected device.

8.8 CVSS 3.1 High EPSS 2.7% · top 13.6% CWE-77 · Command injectionCWE-78 · OS command injection
8.8CVSS 3.1 base score, v2 9.0
2.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to perform a command injection attack on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using the web-based management interface to execute a command using crafted input. A successful exploit could allow the attacker to execute arbitrary commands using root-level privileges on an affected device.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsi2-command-inject-CGyC8y2R Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsi2-command-inject-CGyC8y2R Vendor Advisory

Track CVE-2021-34748 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2021-44228Apache Log4j2 JNDI lookup remote code executionApache Log4j2 versions 2.0-beta9 through 2.15.0 (excluding 2.12.2, 2.12.3, and 2.3.1) do not protect against attacker-controlled LDAP and other JNDI …KEVEPSS 100%analysed8.3CVE-2021-1600Cisco intersight virtual appliance improper access control vulnerabilityMultiple vulnerabilities in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access sensitive internal service…EPSS 0.40%8.3CVE-2021-1601Cisco intersight virtual appliance improper access control vulnerabilityMultiple vulnerabilities in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access sensitive internal service…EPSS 0.40%7.2CVE-2021-1618Cisco intersight virtual appliance os command injection vulnerabilityMultiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to…EPSS 2.7%6.5CVE-2021-1617Cisco intersight virtual appliance path traversal vulnerabilityMultiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to…EPSS 1.5%4.3CVE-2023-20237Cisco intersight virtual appliance improper access control vulnerabilityA vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are oth…EPSS 0.27%9.8CVE-2026-116779Freeswitch command injection vulnerabilityFreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation tha…KEVEPSS 2.5%2.7CVE-2026-41709Vmware esxi vulnerabilityVMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without t…KEVEPSS 0.69%

Source: NIST National Vulnerability Database (record CVE-2021-34748), CISA KEV, FIRST EPSS (scores of 2026-11-12). This page is refreshed as NVD updates the record.