// For flags

CVE-2021-1356

Cisco IOS XE Software Web UI Denial of Service Vulnerabilities

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Multiple vulnerabilities in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to cause the web UI software to become unresponsive and consume vty line instances, resulting in a denial of service (DoS) condition. These vulnerabilities are due to insufficient error handling in the web UI. An attacker could exploit these vulnerabilities by sending crafted HTTP packets to an affected device. A successful exploit could allow the attacker to cause the web UI software to become unresponsive and consume all available vty lines, preventing new session establishment and resulting in a DoS condition. Manual intervention would be required to regain web UI and vty session functionality. Note: These vulnerabilities do not affect the console connection.

Múltiples vulnerabilidades en la Interfaz de Usuario Web del Software Cisco IOS XE, podrían permitir a un atacante remoto autenticado con privilegios de solo lectura causar que el software de la Interfaz de Usuario Web deje de responder y consuma instancias de línea vty, lo que resultará en una condición de denegación de servicio (DoS). Estas vulnerabilidades son debido a un manejo insuficiente de errores en la Interfaz de Usuario Web. Un atacante podría explotar estas vulnerabilidades mediante el envío de paquetes HTTP diseñados a un dispositivo afectado. Una explotación con éxito podría permitir que el atacante cause que el software de la Interfaz de Usuario Web dejara de responder y consumiera todas las líneas vty disponibles, impidiendo el establecimiento de una nueva sesión y dando como resultado una condición de DoS. Se necesitaría una intervención manual para recuperar la interfaz de usuario web y la funcionalidad de la sesión vty. Nota: estas vulnerabilidades no afectan la conexión de la consola

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2020-11-13 CVE Reserved
  • 2021-03-24 CVE Published
  • 2024-06-25 EPSS Updated
  • 2024-11-08 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
  • CWE-755: Improper Handling of Exceptional Conditions
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
Ios Xe
Search vendor "Cisco" for product "Ios Xe"
3.15.1xbs
Search vendor "Cisco" for product "Ios Xe" and version "3.15.1xbs"
-
Affected
Cisco
Search vendor "Cisco"
Ios Xe
Search vendor "Cisco" for product "Ios Xe"
3.15.2xbs
Search vendor "Cisco" for product "Ios Xe" and version "3.15.2xbs"
-
Affected
Cisco
Search vendor "Cisco"
Ios Xe
Search vendor "Cisco" for product "Ios Xe"
17.1.1
Search vendor "Cisco" for product "Ios Xe" and version "17.1.1"
-
Affected
Cisco
Search vendor "Cisco"
Ios Xe
Search vendor "Cisco" for product "Ios Xe"
17.1.1a
Search vendor "Cisco" for product "Ios Xe" and version "17.1.1a"
-
Affected
Cisco
Search vendor "Cisco"
Ios Xe
Search vendor "Cisco" for product "Ios Xe"
17.1.1s
Search vendor "Cisco" for product "Ios Xe" and version "17.1.1s"
-
Affected
Cisco
Search vendor "Cisco"
Ios Xe
Search vendor "Cisco" for product "Ios Xe"
17.1.1t
Search vendor "Cisco" for product "Ios Xe" and version "17.1.1t"
-
Affected
Cisco
Search vendor "Cisco"
Ios Xe
Search vendor "Cisco" for product "Ios Xe"
17.1.2
Search vendor "Cisco" for product "Ios Xe" and version "17.1.2"
-
Affected
Cisco
Search vendor "Cisco"
Ios Xe
Search vendor "Cisco" for product "Ios Xe"
17.2.1
Search vendor "Cisco" for product "Ios Xe" and version "17.2.1"
-
Affected
Cisco
Search vendor "Cisco"
Ios Xe
Search vendor "Cisco" for product "Ios Xe"
17.2.1a
Search vendor "Cisco" for product "Ios Xe" and version "17.2.1a"
-
Affected
Cisco
Search vendor "Cisco"
Ios Xe
Search vendor "Cisco" for product "Ios Xe"
17.2.1r
Search vendor "Cisco" for product "Ios Xe" and version "17.2.1r"
-
Affected
Cisco
Search vendor "Cisco"
Ios Xe
Search vendor "Cisco" for product "Ios Xe"
17.2.1v
Search vendor "Cisco" for product "Ios Xe" and version "17.2.1v"
-
Affected
Cisco
Search vendor "Cisco"
Ios Xe
Search vendor "Cisco" for product "Ios Xe"
17.2.2
Search vendor "Cisco" for product "Ios Xe" and version "17.2.2"
-
Affected
Cisco
Search vendor "Cisco"
Ios Xe
Search vendor "Cisco" for product "Ios Xe"
17.2.3
Search vendor "Cisco" for product "Ios Xe" and version "17.2.3"
-
Affected