PT-2021-2502 · Cisco · Cisco Ios Xe

Published 2021-03-24 · Updated 2022-04-25 · CVE-2021-1394

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software for Cisco Network Convergence System (NCS) 520 Routers (affected versions not specified)

Description: A vulnerability in the ingress traffic manager could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition in the web management interface of an affected device. This is due to incorrect processing of certain IPv4 TCP traffic destined to an affected device. An attacker could exploit this by sending a large number of crafted TCP packets to the affected device, causing the web management interface to become unavailable. Note that this vulnerability does not impact traffic going through the device or to the Management Ethernet interface.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2021-01878

CVE-2021-1394

Affected Products

Cisco Ios Xe

References · 5

• https://bdu.fstec.ru/vul/2021-01878 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs520-tcp-ZpzzOxB · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs520-tcp-ZpzzOxB · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1394 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1394 · Vendor Advisory