CVE-2021-1542: Cisco SF220-24 Firmware

High severity, CVSS 8.1. EPSS: 1.4% chance of exploitation in the next 30 days.

Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

• Cisco SF220-24 Firmware: before 1.2.0.6 (fixed in 1.2.0.6)
• Cisco SF220-24p Firmware: before 1.2.0.6 (fixed in 1.2.0.6)
• Cisco SF220-48 Firmware: before 1.2.0.6 (fixed in 1.2.0.6)
• Cisco SF220-48p Firmware: before 1.2.0.6 (fixed in 1.2.0.6)
• Cisco SG220-26 Firmware: before 1.2.0.6 (fixed in 1.2.0.6)
• Cisco SG220-26p Firmware: before 1.2.0.6 (fixed in 1.2.0.6)
• Cisco SG220-28mp Firmware: before 1.2.0.6 (fixed in 1.2.0.6)
• Cisco SG220-50 Firmware: before 1.2.0.6 (fixed in 1.2.0.6)
• Cisco SG220-50p Firmware: before 1.2.0.6 (fixed in 1.2.0.6)

Published 2021-06-16. Last modified 2026-06-17.