CVE-2021-1619
A vulnerability in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass NETCONF or RESTCONF authentication and do either of the following: Install,…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.76%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass NETCONF or RESTCONF authentication and do either of the following: Install, manipulate, or delete the configuration of an affected device Cause memory corruption that results in a denial of service (DoS) on an affected device This vulnerability is due to an uninitialized variable. An attacker could exploit this vulnerability by sending a series of NETCONF or RESTCONF requests to an affected device. A successful exploit could allow the attacker to use NETCONF or RESTCONF to install, manipulate, or delete the configuration of a network device or to corrupt memory on the device, resulting a DoS.
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- EPSS
- 1.76% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-824, CWE-908
- Affected
- cisco/ios xe · cisco/ios xe sd-wan · cisco/ios xe sd-wan 16.10.1 when installed on 1000 series integrated services · cisco/ios xe sd-wan 16.10.1 when installed on 4000 series integrated services · cisco/ios xe sd-wan 16.10.1 when installed on asr 1000 series aggregation services · cisco/ios xe sd-wan 16.10.1 when installed on integrated services virtual · cisco/ios xe sd-wan 16.10.2 when installed on 1000 series integrated services · cisco/ios xe sd-wan 16.10.2 when installed on 4000 series integrated services · cisco/ios xe sd-wan 16.10.2 when installed on asr 1000 series aggregation services · cisco/ios xe sd-wan 16.10.2 when installed on integrated services virtual · cisco/ios xe sd-wan 16.10.3 when installed on 1000 series integrated services · cisco/ios xe sd-wan 16.10.3 when installed on 4000 series integrated services · cisco/ios xe sd-wan 16.10.3 when installed on asr 1000 series aggregation services · cisco/ios xe sd-wan 16.10.3 when installed on integrated services virtual · cisco/ios xe sd-wan 16.10.3a when installed on 1000 series integrated services · cisco/ios xe sd-wan 16.10.3a when installed on 4000 series integrated services · cisco/ios xe sd-wan 16.10.3a when installed on asr 1000 series aggregation services · cisco/ios xe sd-wan 16.10.3a when installed on cloud services router 1000v · cisco/ios xe sd-wan 16.10.3a when installed on integrated services virtual · cisco/ios xe sd-wan 16.10.3b when installed on 1000 series integrated services · +40 more
- Source
- psirt@cisco.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.