PT-2021-2478 · Cisco · Cisco Ios Xe Sd-Wan+1

James Spadaro Iii · Published 2021-03-24 · Updated 2021-03-29 · CVE-2021-1433

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE SD-WAN Software (affected versions not specified)

Description A vulnerability in the vDaemon process could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. This issue is due to insufficient bounds checking when the device processes traffic. An attacker could exploit this vulnerability by sending crafted traffic to the device, potentially allowing them to conduct a controllable buffer overflow attack or cause a device reload, resulting in a denial of service (DoS) condition. The attacker must have a man-in-the-middle position between Cisco vManage and an associated device that is running an affected version of Cisco IOS XE SD-WAN Software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2021-01846

CVE-2021-1433

Affected Products

Cisco Ios Xe Sd-Wan

Cisco Ios Xe

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-1433 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/663236 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-buffover-CqdRWLc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1433 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01846 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-buffover-CqdRWLc · Vendor Advisory