CVE-2021-1265 Cisco DNA Center Information Disclosure Vulnerability

What is CVE-2021-1265?

CVE-2021-1265 is a high-severity vulnerability in Cisco Digital Network Architecture Center (DNA Center), published on 20 Jan 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the configuration archive functionality of Cisco DNA Center could allow any privilege-level authenticated, remote attacker to obtain the full unmasked running configuration of managed devices. The vulnerability is due to the configuration archives files being stored in clear text, which can be retrieved by various API calls. An attacker could exploit this vulnerability by authenticating to the device and executing a series of API calls. A successful exploit could allow the attacker to retrieve the full unmasked running configurations of managed devices.

Weakness: CWE-312

Which versions are affected by CVE-2021-1265?

It affects 1 product.

Products include Cisco Catalyst Center.

How do I fix CVE-2021-1265?

No fix has been published for CVE-2021-1265 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-1265 being exploited?

There is no known exploitation of CVE-2021-1265 in the wild and no public exploit code.

Other vulnerabilities in Cisco Digital Network Architecture Center (DNA Center)

• CVE-2021-1264 Cisco DNA Center Command Runner Command Injection Vulnerability Critical 9.6
• CVE-2023-20055 Cisco DNA Center Privilege Escalation Vulnerability High 8.0
• CVE-2026-20191 Cisco Catalyst Center Arbitrary File Read Vulnerability High 7.5
• CVE-2024-20350 Cisco Catalyst Center Static SSH Host Key Vulnerability High 7.5
• CVE-2020-3411 Cisco DNA Center Information Disclosure Vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-32x3-2qh2-v3w9.