CVE-2021-1522

A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own password to a value that does not comply with the strong authentication requirements that are configured on an affected device. This vulnerability exists because a password policy check is incomplete at the time a password is changed at server side using the API. An attacker could exploit this vulnerability by sending a specially crafted API request to the affected device. A successful exploit could allow the attacker to change their own password to a value that does not comply with the configured strong authentication requirements.

• CWE-255
• CWE-521

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmx-GkCvfd4Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmx-GkCvfd4Vendor Advisory

Published

Aug 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-1516A vulnerability in the web-based management interface of Cis…6.5
• CVE-2021-1517A vulnerability in the multimedia viewer feature of Cisco We…4.3
• CVE-2021-1518A vulnerability in the REST API of Cisco Firepower Device Ma…8.8
• CVE-2021-1519A vulnerability in the interprocess communication (IPC) chan…5.5
• CVE-2021-1520A vulnerability in the internal message processing of Cisco …6.7
• CVE-2021-1521A vulnerability in the Cisco Discovery Protocol implementati…6.5
• CVE-2021-1523A vulnerability in Cisco Nexus 9000 Series Fabric Switches i…8.6
• CVE-2021-1524A vulnerability in the API of Cisco Meeting Server could all…6.5
• CVE-2021-1525A vulnerability in Cisco Webex Meetings and Cisco Webex Meet…6.1
• CVE-2021-1526A vulnerability in Cisco Webex Player for Windows and MacOS …7.8
• CVE-2021-1527A vulnerability in Cisco Webex Player for Windows and MacOS …6.1
• CVE-2021-1528A vulnerability in the CLI of Cisco SD-WAN Software could al…7.8