Lucene search

CiscoCVE-2021-34723

HistorySep 23, 2021 - 3:15 a.m.

CVE-2021-34723

2021-09-2303:15:18

CWE-668

cisco

web.nvd.nist.gov

vulnerability

cisco

ios xe

sd-wan

software

cli command

overwrite

configuration database

nvd

cve-2021-34723

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

Percentile

5.1%

JSON

A vulnerability in a specific CLI command that is run on Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the configuration database of an affected device. This vulnerability is due to insufficient validation of specific CLI command parameters. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content of the configuration database and gain root-level access to an affected device.

Affected configurations

Nvd

Node

ciscoios_xeMatch17.3.1a

AND

ciscoasr_1000-xMatch-

ciscoasr_1001Match-

ciscoasr_1001-xMatch-

ciscoasr_1002Match-

ciscoasr_1002-xMatch-

ciscoasr_1004Match-

ciscoasr_1006Match-

ciscoasr_1013Match-

ciscoasr_1023Match-

Node

ciscoios_xeMatch17.3.1a

AND

cisco4321_integrated_services_routerMatch-

cisco4331_integrated_services_routerMatch-

cisco4351_integrated_services_routerMatch-

cisco4431_integrated_services_routerMatch-

Node

ciscoios_xeMatch17.3.1a

AND

cisco1100-4g_integrated_services_routerMatch-

cisco1100-4gltegb_integrated_services_routerMatch-

cisco1100-4gltena_integrated_services_routerMatch-

cisco1100-6g_integrated_services_routerMatch-

cisco1100-lte_integrated_services_routerMatch-

cisco1100_integrated_services_routerMatch-

Node

ciscoios_xeMatch17.3.1a

AND

ciscocsr1000vMatch-

VendorProductVersionCPE
ciscoios_xe17.3.1acpe:2.3:o:cisco:ios_xe:17.3.1a:*:*:*:*:*:*:*
ciscoasr_1000-x-cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*
ciscoasr_1001-cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*
ciscoasr_1001-x-cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*
ciscoasr_1002-cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*
ciscoasr_1002-x-cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*
ciscoasr_1004-cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*
ciscoasr_1006-cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*
ciscoasr_1013-cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*
ciscoasr_1023-cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ios_xe	17.3.1a	cpe:2.3:o:cisco:ios_xe:17.3.1a:::::::*
cisco	asr_1000-x	-	cpe:2.3:h:cisco:asr_1000-x:-:::::::*
cisco	asr_1001	-	cpe:2.3:h:cisco:asr_1001:-:::::::*
cisco	asr_1001-x	-	cpe:2.3:h:cisco:asr_1001-x:-:::::::*
cisco	asr_1002	-	cpe:2.3:h:cisco:asr_1002:-:::::::*
cisco	asr_1002-x	-	cpe:2.3:h:cisco:asr_1002-x:-:::::::*
cisco	asr_1004	-	cpe:2.3:h:cisco:asr_1004:-:::::::*
cisco	asr_1006	-	cpe:2.3:h:cisco:asr_1006:-:::::::*
cisco	asr_1013	-	cpe:2.3:h:cisco:asr_1013:-:::::::*
cisco	asr_1023	-	cpe:2.3:h:cisco:asr_1023:-:::::::*

Rows per page:

1-10 of 211

CNA Affected

[
  {
    "product": "Cisco IOS XE Software",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxesdwan-arbfileov-MVOF3ZZn

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-34723