How severe is CVE-2021-1437?

CVE-2021-1437 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2021-1437 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-1437?

CVE-2021-1437 primarily affects Cisco Aironet Access Point Software. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-1437?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2021-1437 published?

CVE-2021-1437 was published on 2021-03-24 and last updated on 2026-06-17.

CVE-2021-1437

CVE-2021-1437 is a high-severity vulnerability in Cisco Aironet Access Point Software with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-275.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 1% (71st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-275
Affected product: Cisco Aironet Access Point Software
Published: 2021-03-24
Last modified: 2026-06-17

Description

A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device. This vulnerability is due to an unrestricted Trivial File Transfer Protocol (TFTP) configuration. An attacker could exploit this vulnerability by sending a specific TFTP request to an affected device. A successful exploit could allow the attacker to download any file from the filesystem of the affected access point (AP).

Frequently asked questions

What is CVE-2021-1437?: A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device. This vulnerability is due to an unrestricted Trivial File Transfer Protocol (TFTP) configuration. An attacker could exploit this vulnerability by sending a specific TFTP request to an affected device. A successful exploit could allow the attacker to download any file from the filesystem of the affected access point (AP).
How severe is CVE-2021-1437?: CVE-2021-1437 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2021-1437 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-1437?: CVE-2021-1437 primarily affects Cisco Aironet Access Point Software. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-1437?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2021-1437 published?: CVE-2021-1437 was published on 2021-03-24 and last updated on 2026-06-17.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironet-info-disc-BfWqghj

Affected products (3)

cpe:2.3:a:cisco:aironet_access_point_software:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:catalyst_9800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:wireless_lan_controller_software:*:*:*:*:*:*:*:*

More vulnerabilities in Cisco Aironet Access Point Software

CVE-2017-3831 — Critical (CVSS 9.8): A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an…
CVE-2022-20622 — High (CVSS 8.6): A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points…
CVE-2020-3560 — High (CVSS 8.6): A vulnerability in Cisco Aironet Access Points (APs) could allow an unauthenticated, remote attacker to cause a denial…
CVE-2020-3559 — High (CVSS 8.6): A vulnerability in Cisco Aironet Access Point (AP) Software could allow an unauthenticated, remote attacker to cause an…
CVE-2018-0234 — High (CVSS 8.6): A vulnerability in the implementation of Point-to-Point Tunneling Protocol (PPTP) functionality in Cisco Aironet 1810,…
CVE-2016-1419 — High (CVSS 8.1): Cisco Access Point devices with software 8.2(102.43) allow remote attackers to cause a denial of service (device…

All CVEs affecting Cisco Aironet Access Point Software →

Other CWE-275 vulnerabilities

CVE-2017-6513 — Critical (CVSS 9.9): The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which…
CVE-2017-17060 — Critical (CVSS 9.8): OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions.
CVE-2017-16887 — Critical (CVSS 9.8): The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to…
CVE-2023-39399 — Critical (CVSS 9.1): Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause…
CVE-2023-39398 — Critical (CVSS 9.1): Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause…
CVE-2019-2177 — High (CVSS 8.8): In isPreferred of HidProfile.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible device type confusion…

Browse all CWE-275 vulnerabilities →