Lucene search

CiscoCVE-2021-1394

HistoryMar 24, 2021 - 8:15 p.m.

CVE-2021-1394

2021-03-2420:15:14

CWE-399

cisco

web.nvd.nist.gov

cisco

ncs 520 routers

vulnerability

dos

remote attacker

web interface

nvd

cve-2021-1394

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.002

Percentile

51.4%

JSON

A vulnerability in the ingress traffic manager of Cisco IOS XE Software for Cisco Network Convergence System (NCS) 520 Routers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition in the web management interface of an affected device. This vulnerability is due to incorrect processing of certain IPv4 TCP traffic that is destined to an affected device. An attacker could exploit this vulnerability by sending a large number of crafted TCP packets to the affected device. A successful exploit could allow the attacker to cause the web management interface to become unavailable, resulting in a DoS condition. Note: This vulnerability does not impact traffic that is going through the device or going to the Management Ethernet interface of the device.

Affected configurations

Nvd

Node

ciscoios_xeMatch16.10.1

ciscoios_xeMatch16.10.1a

ciscoios_xeMatch16.10.1b

ciscoios_xeMatch16.10.1c

ciscoios_xeMatch16.10.1d

ciscoios_xeMatch16.10.1e

ciscoios_xeMatch16.10.1f

ciscoios_xeMatch16.10.1g

ciscoios_xeMatch16.10.1s

ciscoios_xeMatch17.2.1v

VendorProductVersionCPE
ciscoios_xe16.10.1cpe:2.3:o:cisco:ios_xe:16.10.1:*:*:*:*:*:*:*
ciscoios_xe16.10.1acpe:2.3:o:cisco:ios_xe:16.10.1a:*:*:*:*:*:*:*
ciscoios_xe16.10.1bcpe:2.3:o:cisco:ios_xe:16.10.1b:*:*:*:*:*:*:*
ciscoios_xe16.10.1ccpe:2.3:o:cisco:ios_xe:16.10.1c:*:*:*:*:*:*:*
ciscoios_xe16.10.1dcpe:2.3:o:cisco:ios_xe:16.10.1d:*:*:*:*:*:*:*
ciscoios_xe16.10.1ecpe:2.3:o:cisco:ios_xe:16.10.1e:*:*:*:*:*:*:*
ciscoios_xe16.10.1fcpe:2.3:o:cisco:ios_xe:16.10.1f:*:*:*:*:*:*:*
ciscoios_xe16.10.1gcpe:2.3:o:cisco:ios_xe:16.10.1g:*:*:*:*:*:*:*
ciscoios_xe16.10.1scpe:2.3:o:cisco:ios_xe:16.10.1s:*:*:*:*:*:*:*
ciscoios_xe17.2.1vcpe:2.3:o:cisco:ios_xe:17.2.1v:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ios_xe	16.10.1	cpe:2.3:o:cisco:ios_xe:16.10.1:::::::*
cisco	ios_xe	16.10.1a	cpe:2.3:o:cisco:ios_xe:16.10.1a:::::::*
cisco	ios_xe	16.10.1b	cpe:2.3:o:cisco:ios_xe:16.10.1b:::::::*
cisco	ios_xe	16.10.1c	cpe:2.3:o:cisco:ios_xe:16.10.1c:::::::*
cisco	ios_xe	16.10.1d	cpe:2.3:o:cisco:ios_xe:16.10.1d:::::::*
cisco	ios_xe	16.10.1e	cpe:2.3:o:cisco:ios_xe:16.10.1e:::::::*
cisco	ios_xe	16.10.1f	cpe:2.3:o:cisco:ios_xe:16.10.1f:::::::*
cisco	ios_xe	16.10.1g	cpe:2.3:o:cisco:ios_xe:16.10.1g:::::::*
cisco	ios_xe	16.10.1s	cpe:2.3:o:cisco:ios_xe:16.10.1s:::::::*
cisco	ios_xe	17.2.1v	cpe:2.3:o:cisco:ios_xe:17.2.1v:::::::*

CNA Affected

[
  {
    "product": "Cisco IOS XE Software",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs520-tcp-ZpzzOxB

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.002

Percentile

51.4%

JSON

Related for CVE-2021-1394