Lucene search

CiscoCVE-2021-40113

HistoryNov 04, 2021 - 4:15 p.m.

CVE-2021-40113

2021-11-0416:15:09

CWE-284

CWE-78

cisco

web.nvd.nist.gov

cisco

catalyst

pon

switches

ont

vulnerabilities

web-based

management interface

remote attack

telnet

command injection

configuration

cve-2021-40113

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

61.4%

JSON

Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory.

Affected configurations

Nvd

Node

ciscocatalyst_pon_switch_cgp-ont-1p_firmwareRange<1.1.1.14

AND

ciscocatalyst_pon_switch_cgp-ont-1p

Node

ciscocatalyst_pon_switch_cgp-ont-4p_firmwareRange<1.1.3.17

AND

ciscocatalyst_pon_switch_cgp-ont-4p

Node

ciscocatalyst_pon_switch_cgp-ont-4pvc_firmwareRange<1.1.3.17

AND

ciscocatalyst_pon_switch_cgp-ont-4pvc

Node

ciscocatalyst_pon_switch_cgp-ont-4tvcw_firmwareRange<1.1.3.17

AND

ciscocatalyst_pon_switch_cgp-ont-4tvcw

Node

ciscocatalyst_pon_switch_cgp-ont-4pv_firmwareRange<1.1.3.17

AND

ciscocatalyst_pon_switch_cgp-ont-4pv

CNA Affected

[
  {
    "product": "Cisco Catalyst PON Series ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-catpon-multivulns-CE3DSYGr

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

61.4%

JSON

Related for CVE-2021-40113