PT-2021-5176 · Cisco · Cisco Ios Xe

Published 2021-09-22 · Updated 2021-11-23 · CVE-2021-1622

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers (affected versions not specified)

Description A vulnerability in the Common Open Policy Service (COPS) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause resource exhaustion, resulting in a denial of service (DoS) condition. This is due to a deadlock condition in the code when processing COPS packets under certain conditions. An attacker could exploit this by sending COPS packets with high burst rates to an affected device, causing the CPU to consume excessive resources and preventing other control plane processes from obtaining resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Locking

Weakness Enumeration

CWE-667

CWE-833

Related Identifiers

BDU:2021-05976

CVE-2021-1622

Affected Products

Cisco Ios Xe

References · 7

• https://osv.dev/vulnerability/CVE-2021-1622 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1622 · Security Note
• https://bdu.fstec.ru/vul/2021-05976 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cbr8-cops-Vc2ZsJSx · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cbr8-cops-Vc2ZsJSx · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/669677 · Security Note
• https://t.me/cvenotify/23655 · Telegram Post