PT-2021-5709 · Cisco · Cisco Business 220 Series Smart Switches

Jasper Lievisse Adriaanse · Published 2021-10-06 · Updated 2022-10-24 · CVE-2021-34757

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Business 220 Series Smart Switches (affected versions not specified)

Description The issue is related to a lack of protection for service data in the firmware of Cisco Small Business 220 Series Smart Switches. An attacker with Administrator privileges could exploit this to access sensitive login credentials or reconfigure passwords on user accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Using Hardcoded Credentials

Weakness Enumeration

CWE-540

CWE-200

CWE-798

Related Identifiers

BDU:2022-00151

CVE-2021-34757

Affected Products

Cisco Business 220 Series Smart Switches

References · 8

• https://bdu.fstec.ru/vul/2022-00151 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34757 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-hardcoded-cred-MJCEXvX · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34757 · Vendor Advisory
• https://t.me/cvenotify/22033 · Telegram Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-hardcoded-cred-MJCEXvX?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Business%20220%20Series%20Smart%20Switches%20Static%20Key%20and%20Password%20Vulnerabilities&vs_k=1 · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-hardcoded-cred-MJCEXvX?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Business%20220%20Series%20Smart%20Switches%20Static%20Key%20and%20Password%20Vulnerabilities&vs_k=1 · Note
• https://t.me/cibsecurity/30115 · Telegram Post