PT-2021-1916 · Cisco · Cisco Network Convergence System (Ncs) 540 Series Routers+2

Published 2021-02-03 · Updated 2021-02-08 · CVE-2021-1136

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Network Convergence System (NCS) 540 Series Routers versions running Cisco IOS XR NCS540L software images Cisco IOS XR Software for the Cisco 8000 Series Routers (affected versions not specified)

Description The issue is related to multiple vulnerabilities in Cisco IOS XR software that could allow an authenticated, local attacker to execute unsigned code during the boot process on an affected device. This is due to errors in cryptographic signature verification in the Grub bootloader. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For Cisco Network Convergence System (NCS) 540 Series Routers running Cisco IOS XR NCS540L software images, update to a version that includes the fix for these vulnerabilities. For Cisco IOS XR Software for the Cisco 8000 Series Routers, update to a version that includes the fix for these vulnerabilities. As a temporary workaround, consider restricting access to the boot process to minimize the risk of exploitation.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2021-00706

CVE-2021-1136

Affected Products

Cisco 8000 Series Routers

Cisco Ios Xr

Cisco Network Convergence System (Ncs) 540 Series Routers

References · 5

• https://bdu.fstec.ru/vul/2021-00706 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1136 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ioxr-l-zNhcGCBt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1136 · Security Note
• https://t.me/cibsecurity/23098 · Telegram Post