PT-2021-5050 · Cisco · Cisco Business 220 Series Smart Switches

Jasper Lievisse Adriaanse · Published 2021-10-06 · Updated 2022-10-24 · CVE-2021-34744

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Business 220 Series Smart Switches (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the firmware of Cisco Business 220 Series Smart Switches. These vulnerabilities could allow an attacker with Administrator privileges to access sensitive login credentials or reconfigure the passwords on the user account. The vulnerability is associated with a lack of protection for service data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Using Hardcoded Credentials

Weakness Enumeration

CWE-540

CWE-200

CWE-798

Related Identifiers

BDU:2021-05822

CVE-2021-34744

Affected Products

Cisco Business 220 Series Smart Switches

References · 6

• https://bdu.fstec.ru/vul/2021-05822 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-hardcoded-cred-MJCEXvX · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34744 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34744 · Security Note
• https://t.me/cvenotify/22035 · Telegram Post
• https://t.me/cvenotify/22008 · Telegram Post