CVE-2021-1522 Cisco Connected Mobile Experiences Strong Authentication Requirements Enforcement Bypass

Medium 4.3 Published 4 Aug 2021 Updated 7 Nov 2024

Authenticated attackers can bypass strong password policy enforcement via the change password API in Cisco Connected Mobile Experiences.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-1522?

CVE-2021-1522 is a medium-severity vulnerability in Cisco Connected Mobile Experiences, published on 4 Aug 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own password to a value that does not comply with the strong authentication requirements that are configured on an affected device. This vulnerability exists because a password policy check is incomplete at the time a password is changed at server side using the API. An attacker could exploit this vulnerability by sending a specially crafted API request to the affected device. A successful exploit could allow the attacker to change their own password to a value that does not comply with the configured strong authentication requirements.

Weakness: CWE-521, CWE-255

Which versions are affected by CVE-2021-1522?

It affects 1 product.

Products include Cisco Connected Mobile Experiences.

How do I fix CVE-2021-1522?

No fix has been published for CVE-2021-1522 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-1522 being exploited?

There is no known exploitation of CVE-2021-1522 in the wild and no public exploit code.

Sources

Also known as GHSA-8xp5-3f4x-88fr.