Lucene search

K
cveMitreCVE-2021-26928
HistoryJun 04, 2021 - 9:15 p.m.

CVE-2021-26928

2021-06-0421:15:07
CWE-306
mitre
web.nvd.nist.gov
59
7
cve-2021-26928
bird
bgp
authentication
route redirection
denial of service
information disclosure
tigera

CVSS2

4.9

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:N/A:P

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

35.2%

BIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. Because of this, products that use BIRD (which may, for example, include Tigera products in some configurations, as well as products of other vendors) may have been susceptible to route redirection for Denial of Service and/or Information Disclosure. NOTE: a researcher has asserted that the behavior is within Tigera’s area of responsibility; however, Tigera disagrees

Affected configurations

Nvd
Node
nicbirdRange≀2.0.7
VendorProductVersionCPE
nicbird*cpe:2.3:a:nic:bird:*:*:*:*:*:*:*:*

Social References

More

CVSS2

4.9

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:N/A:P

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

35.2%

Related for CVE-2021-26928