CVE-2011-2547

Severity: critical (CVSS 9.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-07-28 · updated 2026-06-16
Weakness: CWE-264

Description

The web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote authenticated users to execute arbitrary commands via crafted parameters to web forms, aka Bug ID CSCtq65681.

Affected products

Cisco Sa500 Software: through 2.1.18; 1.0.14, 1.0.15, 1.0.17, 1.0.39, 1.1.21, 1.1.42 (+1)
Cisco Sa520: all versions
Cisco Sa520W: all versions
Cisco Sa540: all versions

References

http://secunia.com/advisories/45355
http://securitytracker.com/id?1025810
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b8915e.shtml
http://www.securityfocus.com/bid/48810
https://exchange.xforce.ibmcloud.com/vulnerabilities/68738
http://secunia.com/advisories/45355
http://securitytracker.com/id?1025810
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b8915e.shtml
http://www.securityfocus.com/bid/48810
https://exchange.xforce.ibmcloud.com/vulnerabilities/68738

Get alerted when CVE-2011-2547 or the next vulnerability affects your stack