---
id: CVE-2021-1437
title: >-
  Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure
  Vulnerability (CVE-2021-1437)
summary: "A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device.\r\n\r\nThis vulnerability is due to a…"
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: vendor
vendor: Cisco
product: Cisco Aironet Access Point Software (IOS XE Controller)
affected:
  - aironet_access_point_software_ios_xe_controller
  - aironet_access_point_software
published: '2021-03-24'
updated: '2021-03-24'
sourceUpdated: '2021-03-24T16:00:00+00:00'
source: CSAF
sourceUrl: >-
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironet-info-disc-BfWqghj
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironet-info-disc-BfWqghj
  - url: 'https://software.cisco.com'
tags:
  - csaf
  - vendor-advisory
  - cisco
epss: 0.01494
epssPercentile: 0.73034
ingestedAt: '2026-09-08T15:58:18.538Z'
---

## Overview

A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device.

This vulnerability is due to an unrestricted Trivial File Transfer Protocol (TFTP) configuration. An attacker could exploit this vulnerability by sending a specific TFTP request to an affected device. A successful exploit could allow the attacker to download any file from the filesystem of the affected access point (AP).

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

## Vendor advisories

- **cisco-sa-aironet-info-disc-BfWqghj** · Cisco · affected: Cisco Aironet Access Point Software (IOS XE Controller), Cisco Aironet Access Point Software · updated 2021-03-24 · [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironet-info-disc-BfWqghj)

**Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure Vulnerability**. Released 2021-03-24.

Affected:

- Cisco Aironet Access Point Software (IOS XE Controller)
- Cisco Aironet Access Point Software

## Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com