CVE-2021-1128: Cisco IOS XR Software Unauthorized Information Disclosure Vulnerability

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-04 · updated 2026-06-17
Weakness: CWE-201

Description

A vulnerability in the CLI parser of Cisco IOS XR Software could allow an authenticated, local attacker to view more information than their privileges allow. The vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit this vulnerability by using a specific command at the command line. A successful exploit could allow the attacker to obtain sensitive information within the configuration that otherwise might not have been accessible beyond the privileges of the invoking user.

Affected products

Cisco IOS XR Software: before 7.1.2; 7.2.0, 7.3.0 — fixed in 7.1.2

How to fix

Upgrade to a fixed version: Cisco IOS XR Software 7.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-1128 or the next vulnerability affects your stack