Lucene search

CiscoCVE-2021-40112

HistoryNov 04, 2021 - 4:15 p.m.

CVE-2021-40112

2021-11-0416:15:09

CWE-284

cisco

web.nvd.nist.gov

cisco

catalyst

passive optical network

pon

switches

ont

vulnerabilities

web-based management

remote attacker

unauthorized access

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

47.8%

JSON

Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory.

Affected configurations

Nvd

Node

ciscocatalyst_pon_switch_cgp-ont-1p

AND

ciscocatalyst_pon_switch_cgp-ont-1p_firmwareRange<1.1.1.14

Node

ciscocatalyst_pon_switch_cgp-ont-4p

AND

ciscocatalyst_pon_switch_cgp-ont-4p_firmwareRange<1.1.3.17

Node

ciscocatalyst_pon_switch_cgp-ont-4pvc

AND

ciscocatalyst_pon_switch_cgp-ont-4pvc_firmwareRange<1.1.3.17

Node

ciscocatalyst_pon_switch_cgp-ont-4tvcw

AND

ciscocatalyst_pon_switch_cgp-ont-4tvcw_firmwareRange<1.1.3.17

Node

ciscocatalyst_pon_switch_cgp-ont-4pv

AND

ciscocatalyst_pon_switch_cgp-ont-4pv_firmwareRange<1.1.3.17

CNA Affected

[
  {
    "product": "Cisco Catalyst PON Series ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-catpon-multivulns-CE3DSYGr

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

47.8%

JSON

Related for CVE-2021-40112