PT-2021-2352 · Cisco · Cisco Ios Xe

X.B · Published 2021-03-24 · Updated 2021-03-29 · CVE-2021-1398

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description The issue exists due to incorrect validations of specific function arguments that are passed to the boot script, allowing an attacker to execute arbitrary code on the underlying Linux operating system of an affected device. An attacker could exploit this by tampering with a specific file that an affected device would process during the initial boot process. On systems protected by the Unified Extensible Firmware Interface (UEFI) secure boot feature, a successful exploit could allow the attacker to execute unsigned code at boot time and bypass the image verification check in the secure boot process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-489

Related Identifiers

BDU:2021-01590

CVE-2021-1398

Affected Products

Cisco Ios Xe

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-1398 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-ACE-75K3bRWe · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01590 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-ACE-75K3bRWe · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1398 · Vendor Advisory