CVE-2021-1356
Cisco IOS XE Software Web UI Denial of Service Vulnerabilities
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Multiple vulnerabilities in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to cause the web UI software to become unresponsive and consume vty line instances, resulting in a denial of service (DoS) condition. These vulnerabilities are due to insufficient error handling in the web UI. An attacker could exploit these vulnerabilities by sending crafted HTTP packets to an affected device. A successful exploit could allow the attacker to cause the web UI software to become unresponsive and consume all available vty lines, preventing new session establishment and resulting in a DoS condition. Manual intervention would be required to regain web UI and vty session functionality. Note: These vulnerabilities do not affect the console connection.
Múltiples vulnerabilidades en la Interfaz de Usuario Web del Software Cisco IOS XE, podrían permitir a un atacante remoto autenticado con privilegios de solo lectura causar que el software de la Interfaz de Usuario Web deje de responder y consuma instancias de línea vty, lo que resultará en una condición de denegación de servicio (DoS). Estas vulnerabilidades son debido a un manejo insuficiente de errores en la Interfaz de Usuario Web. Un atacante podría explotar estas vulnerabilidades mediante el envío de paquetes HTTP diseñados a un dispositivo afectado. Una explotación con éxito podría permitir que el atacante cause que el software de la Interfaz de Usuario Web dejara de responder y consumiera todas las líneas vty disponibles, impidiendo el establecimiento de una nueva sesión y dando como resultado una condición de DoS. Se necesitaría una intervención manual para recuperar la interfaz de usuario web y la funcionalidad de la sesión vty. Nota: estas vulnerabilidades no afectan la conexión de la consola
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2020-11-13 CVE Reserved
- 2021-03-24 CVE Published
- 2024-06-25 EPSS Updated
- 2024-11-08 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
- CWE-755: Improper Handling of Exceptional Conditions
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 3.15.1xbs Search vendor "Cisco" for product "Ios Xe" and version "3.15.1xbs" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 3.15.2xbs Search vendor "Cisco" for product "Ios Xe" and version "3.15.2xbs" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 17.1.1 Search vendor "Cisco" for product "Ios Xe" and version "17.1.1" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 17.1.1a Search vendor "Cisco" for product "Ios Xe" and version "17.1.1a" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 17.1.1s Search vendor "Cisco" for product "Ios Xe" and version "17.1.1s" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 17.1.1t Search vendor "Cisco" for product "Ios Xe" and version "17.1.1t" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 17.1.2 Search vendor "Cisco" for product "Ios Xe" and version "17.1.2" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 17.2.1 Search vendor "Cisco" for product "Ios Xe" and version "17.2.1" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 17.2.1a Search vendor "Cisco" for product "Ios Xe" and version "17.2.1a" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 17.2.1r Search vendor "Cisco" for product "Ios Xe" and version "17.2.1r" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 17.2.1v Search vendor "Cisco" for product "Ios Xe" and version "17.2.1v" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 17.2.2 Search vendor "Cisco" for product "Ios Xe" and version "17.2.2" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 17.2.3 Search vendor "Cisco" for product "Ios Xe" and version "17.2.3" | - |
Affected
|