What’s Vulnerable › Vulnerabilities

CVE-2021-1538: Cisco Common Services Platform Collector Command Injection Vulnerability

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-04 · updated 2026-06-17
• Weakness: CWE-78

Description

A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to execute arbitrary code. This vulnerability is due to insufficient sanitization of configuration entries. An attacker could exploit this vulnerability by logging in as a super admin and entering crafted input to configuration options on the CSPC configuration dashboard. A successful exploit could allow the attacker to execute remote code as root.

Affected products

• Cisco Common Services Platform Collector Software: before 2.9.1 — fixed in 2.9.1

How to fix

Upgrade to a fixed version: Cisco Common Services Platform Collector Software 2.9.1. Check the vendor advisory for mitigations.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CSPC-CIV-kDuBfNfu
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CSPC-CIV-kDuBfNfu

Get alerted when CVE-2021-1538 or the next vulnerability affects your stack