PT-2021-1921 · Cisco · Cisco Managed Services Accelerator

Published 2021-02-03 · Updated 2021-02-08 · CVE-2021-1266

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Managed Services Accelerator (affected versions not specified)

Description The issue is related to an uncontrolled resource consumption in the REST API implementation of the Cisco Managed Services Accelerator platform. This could allow a remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the way the affected software logs certain API requests. An attacker could exploit this by sending a flood of crafted API requests to an affected device, potentially causing a DoS condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2021-00712

CVE-2021-1266

Affected Products

Cisco Managed Services Accelerator

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-msx-dos-4j7sytvU · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1266 · Security Note
• https://bdu.fstec.ru/vul/2021-00712 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1266 · Vendor Advisory
• https://t.me/cibsecurity/23097 · Telegram Post