PT-2021-4953 · Cisco · Cisco Asyncos+1

Published 2021-11-04 · Updated 2022-10-27 · CVE-2021-34741

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Email Security Appliance (ESA) (affected versions not specified)

Description The issue is related to insufficient input validation of incoming emails in the email scanning algorithm of Cisco AsyncOS software. This could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack against an affected device by sending a crafted email. A successful exploit could exhaust all available CPU resources on an affected device for an extended period, preventing other emails from being processed and resulting in a DoS condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

RCE

Weakness Enumeration

CWE-770

CWE-20

Related Identifiers

BDU:2021-05707

CVE-2021-34741

Affected Products

Cisco Asyncos

Cisco Email Security Appliance

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-dos-JOm9ETfO · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05707 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34741 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34741 · Vendor Advisory