CVE-2021-1492

The Duo Authentication Proxy installer prior to 5.2.1 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can manipulate files used by Duo Authentication Proxy installer, cause Denial of Service (DoS) by deleting file(s), or replace system files to potentially achieve elevation of privileges. This is only exploitable during new installations, while the installer is running, and is not exploitable once installation has finished. Versions 5.2.1 of Duo Authentication Proxy installer addresses this issue.

• CWE-64

• https://help.duo.com/s/article/6789Vendor Advisory
• https://help.duo.com/s/article/6789Vendor Advisory

Published

Mar 25, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-1486A vulnerability in Cisco SD-WAN vManage Software could allow…5.3
• CVE-2021-1487A vulnerability in the web-based management interface of Cis…8.8
• CVE-2021-1488A vulnerability in the upgrade process of Cisco Adaptive Sec…6.7
• CVE-2021-1489A vulnerability in filesystem usage management for Cisco Fir…6.5
• CVE-2021-1490A vulnerability in the web-based management interface of Cis…6.1
• CVE-2021-1491A vulnerability in the web-based management interface of Cis…6.5
• CVE-2021-1493A vulnerability in the web services interface of Cisco Adapt…7.1
• CVE-2021-1494Multiple Cisco products are affected by a vulnerability in t…5.8
• CVE-2021-1495Multiple Cisco products are affected by a vulnerability in t…5.3
• CVE-2021-1496Multiple vulnerabilities in the install, uninstall, and upgr…7.8
• CVE-2021-1497Multiple vulnerabilities in the web-based management interfa…9.8
• CVE-2021-1498Multiple vulnerabilities in the web-based management interfa…9.8