PT-2021-4139 · Cisco · Cisco Ios Xr

Published 2021-09-08 · Updated 2021-09-21 · CVE-2021-34722

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software (affected versions not specified)

Description The issue exists due to the lack of neutralization of special elements used in the operating system command. This could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges.

Recommendations For all affected versions, update to the latest software version that addresses these vulnerabilities, as released by Cisco. At the moment, there is no information about specific versions that contain a fix for this vulnerability, but Cisco has released software updates that address these vulnerabilities. As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation.

Fix

OS Command Injection

Argument Injection

Weakness Enumeration

CWE-78

CWE-88

Related Identifiers

BDU:2021-04732

CVE-2021-34722

Affected Products

Cisco Ios Xr

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-34722 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34722 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04732 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc?vsfCisco20Security20AdvisoryvscatSecurity20IntelligencevstypeRSSvspCisco20IOS20XR20Software20Command20Injection20Vulnerabilitiesvsk1 · Note