PT-2021-4048 · Cisco · Cisco Ios Xr

Published 2021-09-08 · Updated 2023-09-25 · CVE-2021-34718

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software (affected versions not specified)

Description A vulnerability in the SSH Server process could allow an authenticated, remote attacker to overwrite and read arbitrary files on the local device. This issue is due to insufficient input validation of arguments supplied by the user for a specific file transfer method. An attacker with lower-level privileges could exploit this by specifying Secure Copy Protocol (SCP) parameters when authenticating to a device, potentially elevating their privileges and accessing files they should not have access to.

Recommendations For Cisco IOS XR Software, update to a version that includes the fix for this issue, as software updates have been released by Cisco to address this vulnerability. As a temporary workaround, consider restricting access to the Secure Copy Protocol (SCP) parameters to minimize the risk of exploitation. Avoid using the SCP file transfer method until the issue is resolved.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2021-04576

CVE-2021-34718

Affected Products

Cisco Ios Xr

References · 6

• https://bdu.fstec.ru/vul/2021-04576 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-scp-inject-QwZOCv2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34718 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34718 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-scp-inject-QwZOCv2?vsfCisco20Security20AdvisoryvscatSecurity20IntelligencevstypeRSSvspCisco20IOS20XR20Software20Arbitrary20File20Read20and20Write20Vulnerabilityvsk1 · Note
• https://twitter.com/SystemTek_UK/status/1706247180640497816 · Twitter Post