CVE-2021-1398

A vulnerability in the boot logic of Cisco IOS XE Software could allow an authenticated, local attacker with level 15 privileges or an unauthenticated attacker with physical access to execute arbitrary code on the underlying Linux operating system of an affected device. This vulnerability is due to incorrect validations of specific function arguments that are passed to the boot script. An attacker could exploit this vulnerability by tampering with a specific file, which an affected device would process during the initial boot process. On systems that are protected by the Unified Extensible Firmware Interface (UEFI) secure boot feature, a successful exploit could allow the attacker to execute unsigned code at boot time and bypass the image verification check in the secure boot process of the affected device.

• CWE-489

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-ACE-75K3bRWeVendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-ACE-75K3bRWeVendor Advisory

Published

Mar 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-1392A vulnerability in the CLI command permissions of Cisco IOS …7.8
• CVE-2021-1393Multiple vulnerabilities in Cisco Application Services Engin…9.8
• CVE-2021-1394A vulnerability in the ingress traffic manager of Cisco IOS …5.3
• CVE-2021-1395A vulnerability in the web-based management interface of Cis…6.1
• CVE-2021-1396Multiple vulnerabilities in Cisco Application Services Engin…6.5
• CVE-2021-1397A vulnerability in the web-based management interface of Cis…6.1
• CVE-2021-1399A vulnerability in the Self Care Portal of Cisco Unified Com…4.3
• CVE-2021-1400Multiple vulnerabilities in the web-based management interfa…8.8
• CVE-2021-1401Multiple vulnerabilities in the web-based management interfa…7.2
• CVE-2021-1402A vulnerability in the software-based SSL/TLS message handle…8.6
• CVE-2021-1403A vulnerability in the web UI feature of Cisco IOS XE Softwa…7.4
• CVE-2021-1404A vulnerability in the PDF parsing module in Clam AntiVirus …7.5