CVE-2021-1486: Cisco SD-WAN vManage HTTP Authentication User Enumeration Vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-06 · updated 2026-06-17
Weakness: CWE-203

Description

A vulnerability in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to enumerate user accounts. This vulnerability is due to the improper handling of HTTP headers. An attacker could exploit this vulnerability by sending authenticated requests to an affected system. A successful exploit could allow the attacker to compare the HTTP responses that are returned by the affected system to determine which accounts are valid user accounts.

Affected products

Cisco Catalyst SD-WAN Manager: from 20.4 before 20.4.1 — fixed in 20.4.1
Cisco Sd-Wan Vmanage: before 20.3.3 — fixed in 20.3.3

How to fix

Upgrade to a fixed version: Cisco Catalyst SD-WAN Manager 20.4.1; Cisco Sd-Wan Vmanage 20.3.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-1486 or the next vulnerability affects your stack