Details of VAR-202103-0541

ID

VAR-202103-0541

CVE

CVE-2021-1381

TITLE

Cisco IOS XE Active debug code vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-004897

DESCRIPTION

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with high privileges or an unauthenticated attacker with physical access to the device to open a debugging console. The vulnerability is due to insufficient command authorization restrictions. An attacker could exploit this vulnerability by running commands on the hardware platform to open a debugging console. A successful exploit could allow the attacker to access a debugging console. Cisco IOS XE Exists in an active debug code vulnerability.Information may be obtained and information may be tampered with. Cisco IOS XE Software is the American Cisco ( Cisco ) company's operating system. for enterprise wired and wireless access, aggregation, core and WAN single operating system, Cisco IOS XE Reduced business and network complexity

Trust: 1.8

sources: NVD: CVE-2021-1381 // JVNDB: JVNDB-2021-004897 // VULHUB: VHN-374435 // VULMON: CVE-2021-1381

AFFECTED PRODUCTS

vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.1z	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.11.1b	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.2t	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.1y	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.3a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.2.1a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.1.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.2.3	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.1t	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.1za	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.1.1a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.11.2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.2a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.11.1a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.1.2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.1a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.1w	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.1.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.2.1v	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.4a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.2.2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.1.1t	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.1x	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.11.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.4	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.11.1c	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.2.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.11.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.2.1r	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.3	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.3s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.1c	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.2s	Trust: 1.0
vendor:	シスコシステムズ	model:	cisco ios xe	scope:	eq	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco ios xe	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-004897 // NVD: CVE-2021-1381

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-1381
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-1381
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2021-1381
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202103-1442
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-374435
value:	LOW
Trust: 0.1
VULMON:	CVE-2021-1381
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2021-1381
severity:	LOW
baseScore:	3.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-374435
severity:	LOW
baseScore:	3.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-1381
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	0.9
impactScore:	5.2
version:	3.1
Trust: 2.0
NVD:	CVE-2021-1381
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-374435 // VULMON: CVE-2021-1381 // JVNDB: JVNDB-2021-004897 // CNNVD: CNNVD-202103-1442 // NVD: CVE-2021-1381 // NVD: CVE-2021-1381

PROBLEMTYPE DATA

problemtype:	CWE-489	Trust: 1.1
problemtype:	Active debug code (CWE-489) [ Other ]	Trust: 0.8

sources: VULHUB: VHN-374435 // JVNDB: JVNDB-2021-004897 // NVD: CVE-2021-1381

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202103-1442

PATCH

title:	cisco-sa-XE-BLKH-Ouvrnf2s	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-BLKH-Ouvrnf2s	Trust: 0.8
title:	Cisco Cisco IOS XE Software Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=145894	Trust: 0.6
title:	Cisco: Cisco IOS XE Software Active Debug Code Vulnerability	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-XE-BLKH-Ouvrnf2s	Trust: 0.1

sources: VULMON: CVE-2021-1381 // JVNDB: JVNDB-2021-004897 // CNNVD: CNNVD-202103-1442

EXTERNAL IDS

db:	NVD	id:	CVE-2021-1381	Trust: 2.6
db:	JVNDB	id:	JVNDB-2021-004897	Trust: 0.8
db:	CNNVD	id:	CNNVD-202103-1442	Trust: 0.7
db:	VULHUB	id:	VHN-374435	Trust: 0.1
db:	VULMON	id:	CVE-2021-1381	Trust: 0.1

sources: VULHUB: VHN-374435 // VULMON: CVE-2021-1381 // JVNDB: JVNDB-2021-004897 // CNNVD: CNNVD-202103-1442 // NVD: CVE-2021-1381

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-xe-blkh-ouvrnf2s	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2021-1381	Trust: 1.4
url:	https://vigilance.fr/vulnerability/cisco-ios-ios-xe-multiple-vulnerabilities-34940	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/489.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/198691	Trust: 0.1

sources: VULHUB: VHN-374435 // VULMON: CVE-2021-1381 // JVNDB: JVNDB-2021-004897 // CNNVD: CNNVD-202103-1442 // NVD: CVE-2021-1381

SOURCES

db:	VULHUB	id:	VHN-374435
db:	VULMON	id:	CVE-2021-1381
db:	JVNDB	id:	JVNDB-2021-004897
db:	CNNVD	id:	CNNVD-202103-1442
db:	NVD	id:	CVE-2021-1381

LAST UPDATE DATE

2024-08-14T14:38:04.449000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-374435	date:	2021-03-30T00:00:00
db:	VULMON	id:	CVE-2021-1381	date:	2021-03-30T00:00:00
db:	JVNDB	id:	JVNDB-2021-004897	date:	2021-12-01T09:06:00
db:	CNNVD	id:	CNNVD-202103-1442	date:	2021-03-31T00:00:00
db:	NVD	id:	CVE-2021-1381	date:	2023-11-07T03:28:08.867

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-374435	date:	2021-03-24T00:00:00
db:	VULMON	id:	CVE-2021-1381	date:	2021-03-24T00:00:00
db:	JVNDB	id:	JVNDB-2021-004897	date:	2021-12-01T00:00:00
db:	CNNVD	id:	CNNVD-202103-1442	date:	2021-03-24T00:00:00
db:	NVD	id:	CVE-2021-1381	date:	2021-03-24T21:15:12.320