PT-2021-5127 · Cisco · Cisco Asa+1

Santosh Krishnamurthy · Published 2021-10-27 · Updated 2023-08-16 · CVE-2021-40125

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description The issue is related to the Internet Key Exchange Version 2 (IKEv2) implementation, which is affected by improper control of a resource, potentially allowing an authenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. An attacker with the ability to spoof a trusted IKEv2 site-to-site VPN peer and in possession of valid IKEv2 credentials for that peer could exploit this by sending malformed, authenticated IKEv2 messages to an affected device. A successful exploit could allow the attacker to trigger a reload of the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Use After Free

Weakness Enumeration

CWE-400

CWE-416

Related Identifiers

BDU:2021-05921

CVE-2021-40125

Affected Products

Cisco Asa

Cisco Ftd

References · 8

• https://bdu.fstec.ru/vul/2021-05921 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40125 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ikev2-dos-g4cmrr7C · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ikev2-dos-g4cmrr7C · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40125 · Security Note
• https://t.me/cvenotify/22506 · Telegram Post
• https://t.me/cvenotify/22640 · Telegram Post
• https://t.me/cibsecurity/31305 · Telegram Post