PT-2021-4744 · Cisco · Cisco Asr 900+2

Gert Döring · Published 2021-09-22 · Updated 2021-10-05 · CVE-2021-34696

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco ASR 900 and ASR 920 Series Aggregation Services Routers (affected versions not specified)

Description The issue is related to a vulnerability in the access control list (ACL) programming of Cisco ASR 900 and ASR 920 Series Aggregation Services Routers. This vulnerability could allow an unauthenticated, remote attacker to bypass a configured ACL due to incorrect programming of hardware when an ACL is configured using a method other than the configuration CLI. An attacker could exploit this vulnerability by attempting to send traffic through an affected device, potentially allowing them to bypass an ACL on the affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2021-05453

CVE-2021-34696

Affected Products

Cisco Asr 900

Cisco Asr 920

Cisco Ios Xe

References · 6

• https://osv.dev/vulnerability/CVE-2021-34696 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr900acl-UeEyCxkv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34696 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr900acl-UeEyCxkv · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05453 · Security Note
• https://t.me/cibsecurity/29253 · Telegram Post