CVE-2021-1425: asyncos — Fix

Description

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because confidential information is being included in HTTP requests that are exchanged between the user and the device. An attacker could exploit this vulnerability by looking at the raw HTTP requests that are sent to the interface. A successful exploit could allow the attacker to obtain some of the passwords that are configured throughout the interface.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Is your site exposed to CVE-2021-1425?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-201 CWE-201

Affected Products

Vendor	Product	Versions
cisco	asyncos	< 13.8.0
cisco	content_security_management_appliance_smav_m000v	All
cisco	content_security_management_appliance_smav_m100v	All
cisco	content_security_management_appliance_smav_m300v	All
cisco	content_security_management_appliance_smav_m600v	All
cisco	content_security_management_appliance_sma_m190	All
cisco	content_security_management_appliance_sma_m195	All
cisco	content_security_management_appliance_sma_m395	All
cisco	content_security_management_appliance_sma_m690	All
cisco	content_security_management_appliance_sma_m695	All

References

Advisories & Patches

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-info-disclo-VOu2GHbZ

Frequently Asked Questions

What is CVE-2021-1425? +

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because confidential information is being included in HTTP requests that are exchanged between the user and the device. An attacker could exploit this vulnerability by looking at the raw HTTP requests that are sent to the interface. A successful exploit could allow the attacker to obtain some of the passwords that are configured throughout the interface.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. It has a CVSS v3.1 base score of 4.3 (MEDIUM).

How severe is CVE-2021-1425? +

CVE-2021-1425 has a CVSS v3.1 score of 4.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2021-1425? +

CVE-2021-1425 affects products from cisco, specifically: asyncos, content_security_management_appliance_sma_m190, content_security_management_appliance_sma_m195, content_security_management_appliance_sma_m395, content_security_management_appliance_sma_m690, content_security_management_appliance_sma_m695, content_security_management_appliance_smav_m000v, content_security_management_appliance_smav_m100v, content_security_management_appliance_smav_m300v, content_security_management_appliance_smav_m600v. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2021-1425? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-27868

An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration …

CVE-2025-24858

Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the …

CVE-2025-48045

An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.

CVE-2024-7205

When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take …

CVE-2025-8862

YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend …

CVE-2025-64502

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB …

CVE-2021-1425