CVE-2021-1396 describes multiple vulnerabilities in Cisco Application Services Engine and Cisco Application Policy Infrastructure Controller. An unauthenticated, remote attacker could exploit these flaws to gain privileged access to host operations, retrieve device information, create diagnostic files, or make limited configuration changes. With a CVSS score of 6.5 (Medium), the attack vector is network-based with low complexity and no user interaction required, potentially leading to information disclosure and limited integrity impact. While the EPSS score is low and it's not listed in CISA's KEV catalog, there is some media coverage and community discussion, though no public exploit code (Metasploit, Nuclei, ExploitDB) is currently available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.1, < 1.1\(3e\)CPE matchmatch criteria | cpe:2.3:a:cisco:application_services_engine:*:*:*:*:*:*:*:* | ||
1.1.3CPE matchmatch criteria | cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.1.3:c:*:*:*:*:*:* | ||
1.1.3CPE matchmatch criteria | cpe:2.3:a:cisco:application_policy_infrastructure_controller:1.1.3:d:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.