| Vulnerability Name: | CVE-2021-1381 (CCN-198691) |
| Assigned: | 2020-11-13 |
| Published: | 2021-03-24 |
| Updated: | 2021-03-30 |
| Summary: | A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with high privileges or an unauthenticated attacker with physical access to the device to open a debugging console. The vulnerability is due to insufficient command authorization restrictions. An attacker could exploit this vulnerability by running commands on the hardware platform to open a debugging console. A successful exploit could allow the attacker to access a debugging console.
|
| CVSS v3 Severity: | 6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
5.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Physical
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): None |
6.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
5.3 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Physical
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): None |
|
| CVSS v2 Severity: | 3.6 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N)| Exploitability Metrics: | Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None |
6.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:N)| Exploitability Metrics: | Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): None |
|
| Vulnerability Type: | CWE-489
|
| Vulnerability Consequences: | Bypass Security |
| References: | Source: MITRE
Type: CNA
CVE-2021-1381
Source: XF
Type: UNKNOWN
cisco-cve20211381-sec-bypass(198691)
Source: CCN
Type: Cisco Security Advisory cisco-sa-XE-BLKH-Ouvrnf2s
Cisco IOS XE Software Active Debug Code Vulnerability
Source: CISCO
Type: Vendor Advisory
20210324 Cisco IOS XE Software Active Debug Code Vulnerability
|
| Vulnerable Configuration: | Configuration 1:
cpe:/o:cisco:ios_xe:16.11.1:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.11.1a:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.11.1b:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.11.1c:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.11.1s:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.11.2:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1a:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1c:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1s:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1t:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1w:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1x:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1y:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1z:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.1za:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.2:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.2a:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.2s:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.2t:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.3:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.3a:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.3s:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.4:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:16.12.4a:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.1.1:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.1.1a:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.1.1s:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.1.1t:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.1.2:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.2.1:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.2.1a:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.2.1r:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.2.1v:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.2.2:*:*:*:*:*:*:*OR cpe:/o:cisco:ios_xe:17.2.3:*:*:*:*:*:*:*
Configuration CCN 1:
cpe:/o:cisco:ios_xe_software:*:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| BACK |