CVE-2021-1144

CVE-2021-1144 is a high-severity vulnerability in Cisco Connected Mobile Experiences (CMX) that allows an authenticated, non-administrative attacker to change the password of any user, including administrators. This is due to improper authorization checks when handling password change requests. The vulnerability has a CVSS score of 8.8, indicating a high impact on confidentiality, integrity, and availability, as an attacker could impersonate any user. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), it has garnered some community discussion and media coverage, including a SecurityWeek article noting its presence in End-of-Life Cisco routers.