PT-2021-4723 · Cisco · Cisco Asa+1

Published 2021-10-27 · Updated 2023-08-16 · CVE-2021-34794

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description A vulnerability in the Simple Network Management Protocol version 3 (SNMPv3) access control functionality could allow an unauthenticated, remote attacker to query SNMP data. This vulnerability is due to ineffective access control. An attacker could exploit this vulnerability by sending an SNMPv3 query to an affected device from a host that is not permitted by the SNMPv3 access control list. A successful exploit could allow the attacker to send an SNMP query to an affected device and retrieve information from the device. The attacker would need valid credentials to perform the SNMP query.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2021-05429

CVE-2021-34794

Affected Products

Cisco Asa

Cisco Ftd

References · 8

• https://osv.dev/vulnerability/CVE-2021-34794 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-snmpaccess-M6yOweq3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34794 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-snmpaccess-M6yOweq3 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05429 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021102901 · Note
• https://t.me/cvenotify/22513 · Telegram Post
• https://t.me/cibsecurity/31321 · Telegram Post