VulnerabilityModified

CVE-2021-34749

HIGH 8.6EPSS 1.68%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.68%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from a compromised host. This vulnerability is due to inadequate filtering of the SSL handshake. An attacker could exploit this vulnerability by using data from the SSL client hello packet to communicate with an external server. A successful exploit could allow the attacker to execute a command-and-control attack on a compromised host and perform additional data exfiltration attacks.

CVSS 3.1: 8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
EPSS: 1.68% probability · 76th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: cisco/ironport web security appliance · cisco/secure firewall management center · cisco/firepower management center virtual appliance firmware
Source: psirt@cisco.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.