Cisco Wide Area Application Services Software Information Disclosure Vulnerability

Vulnerability

Cisco Wide Area Application Services (WAAS) Software releases 6.4.5a and earlier contain a vulnerability due to improper input validation and authorization of specific CLI commands [1]. An authenticated, local attacker with a low-privileged account can exploit this flaw by issuing a crafted set of CLI commands that bypass intended file access restrictions.

Exploitation

An attacker must first authenticate to the affected device (i.e., have a valid local user account with CLI access). Once authenticated, the attacker issues a specific sequence of commands that leverages the improper input validation and authorization to read files outside their permitted scope [1]. No additional privileges or user interaction beyond authentication are required.

Impact

Successful exploitation allows an authenticated, local attacker to read arbitrary files on the WAAS device that they would otherwise not be permitted to access [1]. This can lead to disclosure of sensitive configuration or operational data, potentially including credentials or other confidential information.

Mitigation

Cisco has released software updates that address CVE-2021-1438. Affected users should upgrade to a fixed version as indicated in the Cisco Security Advisory [1]. There are no workarounds that mitigate this vulnerability; upgrading to a patched release is the only available remediation [1].