PT-2021-2452 · Cisco · Cisco Ios Xe

Fabian Beck + 2 · Published 2021-03-24 · Updated 2024-02-07 · CVE-2021-1220

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software (affected versions not specified)

Description: The issue is due to insufficient error handling in the web UI of Cisco IOS XE Software, allowing an authenticated, remote attacker with read-only privileges to cause the web UI software to become unresponsive and consume vty line instances, resulting in a denial of service (DoS) condition. An attacker could exploit this by sending crafted HTTP packets to an affected device. A successful exploit could allow the attacker to cause the web UI software to become unresponsive and consume all available vty lines, preventing new session establishment and resulting in a DoS condition. Manual intervention would be required to regain web UI and vty session functionality. Note that these vulnerabilities do not affect the console connection.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-01817

CVE-2021-1220

Affected Products

Cisco Ios Xe

References · 6

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xe-webui-dos-z9yqYQAn · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xe-webui-dos-z9yqYQAn · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1220 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01817 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1220 · Security Note
• https://t.me/cvenotify/70459 · Telegram Post