CVE-2021-1442

A vulnerability in a diagnostic command for the Plug-and-Play (PnP) subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to the level of an Administrator user (level 15) on an affected device. The vulnerability is due to insufficient protection of sensitive information. An attacker with low privileges could exploit this vulnerability by issuing the diagnostic CLI show pnp profile when a specific PnP listener is enabled on the device. A successful exploit could allow the attacker to obtain a privileged authentication token. This token can be used to send crafted PnP messages and execute privileged commands on the targeted system.

• CWE-532

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-pnp-priv-esc-AmG3kuVLVendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-pnp-priv-esc-AmG3kuVLVendor Advisory

Published

Mar 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-1436A vulnerability in the CLI of Cisco IOS XE SD-WAN Software c…4.4
• CVE-2021-1437A vulnerability in the FlexConnect Upgrade feature of Cisco …7.5
• CVE-2021-1438A vulnerability in Cisco Wide Area Application Services (WAA…5.5
• CVE-2021-1439A vulnerability in the multicast DNS (mDNS) gateway feature …7.4
• CVE-2021-1440A vulnerability in the implementation of the Resource Public…6.8
• CVE-2021-1441A vulnerability in the hardware initialization routines of C…6.7
• CVE-2021-1443A vulnerability in the web UI of Cisco IOS XE Software could…7.2
• CVE-2021-1444A vulnerability in the web services interface of Cisco …6.1
• CVE-2021-1445Multiple vulnerabilities in Cisco Adaptive Security Applianc…7.5
• CVE-2021-1446A vulnerability in the DNS application layer gateway (ALG) f…7.5
• CVE-2021-1447A vulnerability in the user account management system of Cis…6.7
• CVE-2021-1448A vulnerability in the CLI of Cisco Firepower Threat Defense…7.8