PT-2021-3952 · Cisco · Cisco Intersight Virtual Appliance

Published 2021-07-21 · Updated 2022-07-15 · CVE-2021-1600

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Intersight Virtual Appliance (affected versions not specified)

Description The issue is related to insufficient restrictions for IPv4 or IPv6 packets received on the external management interface, allowing an unauthenticated, adjacent attacker to access sensitive internal services from an external interface. An attacker could exploit this by sending specific traffic to the interface on an affected device, potentially allowing access to sensitive internal services and making configuration changes on the affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2021-04470

CVE-2021-1600

Affected Products

Cisco Intersight Virtual Appliance

References · 6

• https://osv.dev/vulnerability/CVE-2021-1600 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1600 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsi2-iptaclbp-L8Dzs8m8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04470 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20210722.2.pdf · Security Note
• https://t.me/cibsecurity/26407 · Telegram Post