CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS
Percentile
55.7%
According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability.
Please see the included Cisco BIDs and Cisco Security Advisory for more information.
#TRUSTED 72bce8601d66bf485d3555fa5f2709bf51660098373143d805ddc08901540361e45e79fd28ebb66d30b7a353770b29597b31a5271c1a91775cdf650034fd75c8180b0619e706f2187df66ba849fcba96e8f92deba570c552d3f37a1363a8f9124934512bdfbe62a5b24884d26b3d87f756fc2a9f50c761507f6c81e265a5faa35e587a275f9f06acf3e5c466ba77df7363fab6e56e1a2c8d8cc890e826d533c0ca2f2ff948cfa18e4d086f1e58afb638424fe7e03c6af6c6368c7d9ae21c6c4ace408116af455a1c63478ab3b6b5ccb6bb8482c87a25e3a3965c20c0fd60c75560aea4d90598fe51e1bdfbfa635de5403ebc0bee981f2bb0e4d9fc59c7c657884be632b87d6a898cbab19496271a0330854b94e5888600e6106c68e36ca2a377972366c195658ff2a0679acac8bc5409d4a505b60ba803f15c0b04e18356b6031b77ab8549c95509071a2b018def5c6ad8db44b1b8ec64cca54d9964705cb8538d9e9f9426f431e55d763dd0d809079d604343ece53a552c763ccaf9cb6aa71b1dc5bf131659a02dca7c10cb649e1b00b62f1034c7b3932f008b341ed740031a57704f6e492acdfdd8e306f18a93e6d4710496ec5cbde7916b34684dcdd886e143bd2dc805920d8367f5ebed36b310c573e67cc767d3e1d5370b690cabe547458115370a12acbe2efd7aa3a7778a5733f82deb3a1bc2a99e901407183c6eb784
#TRUST-RSA-SHA256 96437283ddce4589fa9fd33799653af6c45d9b88e4428430c6b4c6d7f1e2849b6dadb1ec7f042bcad458d88ab3ef6db18f144940166e68d08cdaaf94d3def8824c3538773baf990b6ea6c39789acced7ec82d19d8ecf8aee4f2c40d2fc7856ef755ddbe5ce9ef913e350c882949eb33992d3c84218c9edbb9bcfbfd8d86fcc3a042559cd05ff4b696da335c1bb52b4f880acc0db8d15a46d3c4844ded753df4693c8b2150652a4627735f24d75358cf5886b21d13cd5ea79ea5e198f2992f3587d179ff2b68fa5de7f73beaf253d4ead33ce2c42e00769dea8d2326f30ecca117f6c5770b024334b171a9c246999703961aea0cd6ad28ad2cc88f27712d75e125278bcc9fe9e3672662ecf5cbcb99c7e3ed8bbef0a5c1f4c0a9e9917c221a1e7509a34e9ff1deae7c4c1068e6aa1d8fe930441c6aff41281d85974afce13c6ca2739ed3f3ed357c1e2c7b3455989c44dcba10c14761e994492bfb62f85a75be7a3b6b63b2e7a6e9071dab876f387375248a28b17152ab45be132acfaafa66b795ae41211c919221e1c32e393db0ffd897235ee63c4f2a6f781288bd51c749923b3b5cc856020a5e6da069aab8b53fb23812f0c227a6cba906a53789512dfa23d2308c047cae398fe6130fc7d01d6a3574d83b7b2e903b538bb0672ea3773cba6dd4b5705f8c6a1d74d1ee5f53497dc233e6e8e2d9551ec769a60e2099dc5c4c0
#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(153560);
script_version("1.12");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/09/28");
script_cve_id("CVE-2021-34770");
script_xref(name:"CISCO-BUG-ID", value:"CSCvw08884");
script_xref(name:"CISCO-SA", value:"cisco-sa-ewlc-capwap-rce-LYgj8Kf");
script_xref(name:"IAVA", value:"2021-A-0441-S");
script_name(english:"Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Remote Code Execution (cisco-sa-ewlc-capwap-rce-LYgj8Kf)");
script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability.
- A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of
Cisco IOS XE Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated,
remote attacker to execute arbitrary code with administrative privileges or cause a denial of service
(DoS) condition on an affected device. The vulnerability is due to a logic error that occurs during the
validation of CAPWAP packets. An attacker could exploit this vulnerability by sending a crafted CAPWAP
packet to an affected device. A successful exploit could allow the attacker to execute arbitrary code with
administrative privileges or cause the affected device to crash and reload, resulting in a DoS condition.
(CVE-2021-34770)
Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-capwap-rce-LYgj8Kf
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f8bccb0c");
script_set_attribute(attribute:"see_also", value:"http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-74581");
script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw08884");
script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvw08884");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-34770");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_cwe_id(122);
script_set_attribute(attribute:"vuln_publication_date", value:"2021/09/22");
script_set_attribute(attribute:"patch_publication_date", value:"2021/09/22");
script_set_attribute(attribute:"plugin_publication_date", value:"2021/09/22");
script_set_attribute(attribute:"plugin_type", value:"combined");
script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"CISCO");
script_copyright(english:"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("cisco_ios_xe_version.nasl");
script_require_keys("Host/Cisco/IOS-XE/Version", "Host/Cisco/IOS-XE/Model");
exit(0);
}
include('ccf.inc');
var product_info = cisco::get_product_info(name:'Cisco IOS XE Software');
var model = toupper(product_info.model);
# Vulnerable model list
if ('CATALYST' >!< model || model !~ '9300|9400|9500|9800|9800-CL')
audit(AUDIT_HOST_NOT, 'affected');
var version_list=make_list(
'3.15.1xbS',
'3.15.2xbS',
'16.6.4s',
'16.10.1',
'16.10.1e',
'16.10.1s',
'16.11.1',
'16.11.1a',
'16.11.1b',
'16.11.1c',
'16.11.2',
'16.12.1',
'16.12.1s',
'16.12.1t',
'16.12.2s',
'16.12.2t',
'16.12.3',
'16.12.3s',
'16.12.4',
'16.12.4a',
'17.1.1',
'17.1.1s',
'17.1.1t',
'17.1.2',
'17.1.3',
'17.2.1',
'17.2.1a',
'17.3.1'
);
var reporting = make_array(
'port' , product_info['port'],
'severity' , SECURITY_HOLE,
'bug_id' , 'CSCvw08884',
'version' , product_info['version'],
'disable_caveat', TRUE
);
cisco::check_and_report(
product_info:product_info,
reporting:reporting,
vuln_versions:version_list
);
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS
Percentile
55.7%