PT-2021-4140 · Cisco · Cisco Ios Xr

Published 2021-09-08 · Updated 2021-09-21 · CVE-2021-34721

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software (affected versions not specified)

Description The issue exists due to the lack of neutralization of special elements used in the operating system command. This could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges.

Recommendations For all affected versions, update to the latest software version that addresses these vulnerabilities, as released by Cisco. At the moment, there is no information about specific workarounds that address these vulnerabilities.

Fix

OS Command Injection

Argument Injection

Weakness Enumeration

CWE-78

CWE-88

Related Identifiers

BDU:2021-04733

CVE-2021-34721

Affected Products

Cisco Ios Xr

References · 6

• https://bdu.fstec.ru/vul/2021-04733 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34721 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34721 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc?vsfCisco20Security20AdvisoryvscatSecurity20IntelligencevstypeRSSvspCisco20IOS20XR20Software20Command20Injection20Vulnerabilitiesvsk1 · Note
• https://t.me/cibsecurity/28563 · Telegram Post