PT-2021-5608 · Cisco · Cisco Ios Xe+1

Published 2021-09-22 · Updated 2023-05-22 · CVE-2021-1620

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS Software and Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the Internet Key Exchange Version 2 (IKEv2) support for the AutoReconnect feature could allow an authenticated, remote attacker to exhaust the free IP addresses from the assigned local pool. This occurs because the code does not release the allocated IP address under certain failure conditions. An attacker could exploit this vulnerability by trying to connect to the device with a non-AnyConnect client. A successful exploit could allow the attacker to exhaust the IP addresses from the assigned local pool, which prevents users from logging in and leads to a denial of service (DoS) condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-563

CWE-772

Related Identifiers

BDU:2022-00042

CVE-2021-1620

Affected Products

Cisco Ios

Cisco Ios Xe

References · 6

• https://bdu.fstec.ru/vul/2022-00042 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ikev2-ebFrwMPr · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/669674 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ikev2-ebFrwMPr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1620 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1620 · Security Note