How severe is CVE-2021-1492?

CVE-2021-1492 has a CVSS 3.x base score of 6.6, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity high, and availability high.

Is CVE-2021-1492 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-1492?

CVE-2021-1492 affects Duo Authentication Proxy. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-1492?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-1492 published?

CVE-2021-1492 was published on 2021-03-25 and last updated on 2026-06-17.

CVE-2021-1492

CVE-2021-1492 is a medium-severity vulnerability in Duo Authentication Proxy with a CVSS 3.x base score of 6.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-64.

Key facts

Severity: Medium (CVSS 3.x base score 6.6)
CVSS v2: 3.6
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-64
Affected product: Duo Authentication Proxy
Published: 2021-03-25
Last modified: 2026-06-17

Description

The Duo Authentication Proxy installer prior to 5.2.1 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can manipulate files used by Duo Authentication Proxy installer, cause Denial of Service (DoS) by deleting file(s), or replace system files to potentially achieve elevation of privileges. This is only exploitable during new installations, while the installer is running, and is not exploitable once installation has finished. Versions 5.2.1 of Duo Authentication Proxy installer addresses this issue.

Frequently asked questions

What is CVE-2021-1492?: The Duo Authentication Proxy installer prior to 5.2.1 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can manipulate files used by Duo Authentication Proxy installer, cause Denial of Service (DoS) by deleting file(s), or replace system files to potentially achieve elevation of privileges. This is only exploitable during new installations, while the installer is running, and is not exploitable once installation has finished. Versions 5.2.1 of Duo Authentication Proxy installer addresses this issue.
How severe is CVE-2021-1492?: CVE-2021-1492 has a CVSS 3.x base score of 6.6, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity high, and availability high.
Is CVE-2021-1492 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-1492?: CVE-2021-1492 affects Duo Authentication Proxy. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-1492?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-1492 published?: CVE-2021-1492 was published on 2021-03-25 and last updated on 2026-06-17.

References

https://help.duo.com/s/article/6789

Affected products (1)

cpe:2.3:a:duo:authentication_proxy:*:*:*:*:*:*:*:*

More vulnerabilities in Duo Authentication Proxy

CVE-2023-20207 — Medium (CVSS 4.9): A vulnerability in the logging component of Cisco Duo Authentication Proxy could allow an authenticated, remote…

All CVEs affecting Duo Authentication Proxy →

Other CWE-64 vulnerabilities

CVE-2025-53503 — High (CVSS 7.8): Trend Micro Cleaner One Pro is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to…
CVE-2025-52521 — High (CVSS 7.8): Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that…
CVE-2025-49385 — High (CVSS 7.8): Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that…
CVE-2025-49384 — High (CVSS 7.8): Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that…
CVE-2025-48443 — Medium (CVSS 6.7): Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Local Privilege…
CVE-2021-41562 — Medium (CVSS 6.1): A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue…

Browse all CWE-64 vulnerabilities →