Sign-up

ID

VAR-202103-0548


CVE

CVE-2021-1375


TITLE

plural  Cisco Catalyst  Runs on series switches  Cisco IOS XE  Digital Signature Verification Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-004895

DESCRIPTION

Multiple vulnerabilities in the fast reload feature of Cisco IOS XE Software running on Cisco Catalyst 3850, Cisco Catalyst 9300, and Cisco Catalyst 9300L Series Switches could allow an authenticated, local attacker to either execute arbitrary code on the underlying operating system, install and boot a malicious software image, or execute unsigned binaries on an affected device. These vulnerabilities are due to improper checks performed by system boot routines. To exploit these vulnerabilities, the attacker would need privileged access to the CLI of the device. A successful exploit could allow the attacker to either execute arbitrary code on the underlying operating system or execute unsigned code and bypass the image verification check part of the secure boot process. For more information about these vulnerabilities, see the Details section of this advisory. plural Cisco Catalyst Runs on series switches Cisco IOS XE Exists in a digital signature validation vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Cisco IOS XE SD-WAN Software is a software for network management (software-defined networking) applied to the Cisco IOS XE network operating system from Cisco

Trust: 1.8

sources: NVD: CVE-2021-1375 // JVNDB: JVNDB-2021-004895 // VULHUB: VHN-374429 // VULMON: CVE-2021-1375

AFFECTED PRODUCTS

vendor:ciscomodel:ios xescope:eqversion:16.6.1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.11.1b

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.2t

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.9.2s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.9.4

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:17.1.1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.9.1s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.6.5

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.9.3a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.6.4a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.10.1s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.11.2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.1s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.6.7

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.6.3

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.8.1s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.6.4

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.5.1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.6.4s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.9.3

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.6.6

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.5.1a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.8.1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.10.1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.10.1e

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.9.2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.6.2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.9.3s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.11.1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.8.1a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.11.1c

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.11.1s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.9.1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.1c

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.12.2s

Trust: 1.0

vendor:シスコシステムズmodel:cisco ios xescope:eqversion: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco ios xescope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-004895 // NVD: CVE-2021-1375

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-1375
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2021-1375
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-1375
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202103-1449
value: MEDIUM

Trust: 0.6

VULHUB: VHN-374429
value: HIGH

Trust: 0.1

VULMON: CVE-2021-1375
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-1375
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-374429
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

ykramarz@cisco.com: CVE-2021-1375
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2021-1375
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-374429 // VULMON: CVE-2021-1375 // JVNDB: JVNDB-2021-004895 // CNNVD: CNNVD-202103-1449 // NVD: CVE-2021-1375 // NVD: CVE-2021-1375

PROBLEMTYPE DATA

problemtype:CWE-347

Trust: 1.1

problemtype:Improper verification of digital signatures (CWE-347) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-374429 // JVNDB: JVNDB-2021-004895 // NVD: CVE-2021-1375

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202103-1449

TYPE

data forgery

Trust: 0.6

sources: CNNVD: CNNVD-202103-1449

PATCH

title:cisco-sa-fast-Zqr6DD5url:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fast-Zqr6DD5

Trust: 0.8

title:Cisco IOS XE SD-WAN Software Repair measures for data forgery problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=145731

Trust: 0.6

title:Cisco: Cisco IOS XE Software Fast Reload Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-fast-Zqr6DD5

Trust: 0.1

sources: VULMON: CVE-2021-1375 // JVNDB: JVNDB-2021-004895 // CNNVD: CNNVD-202103-1449

EXTERNAL IDS

db:NVDid:CVE-2021-1375

Trust: 2.6

db:JVNDBid:JVNDB-2021-004895

Trust: 0.8

db:CNNVDid:CNNVD-202103-1449

Trust: 0.7

db:VULHUBid:VHN-374429

Trust: 0.1

db:VULMONid:CVE-2021-1375

Trust: 0.1

sources: VULHUB: VHN-374429 // VULMON: CVE-2021-1375 // JVNDB: JVNDB-2021-004895 // CNNVD: CNNVD-202103-1449 // NVD: CVE-2021-1375

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-fast-zqr6dd5

Trust: 1.9

url:https://nvd.nist.gov/vuln/detail/cve-2021-1375

Trust: 1.4

url:https://vigilance.fr/vulnerability/cisco-ios-ios-xe-multiple-vulnerabilities-34940

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/347.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/198729

Trust: 0.1

sources: VULHUB: VHN-374429 // VULMON: CVE-2021-1375 // JVNDB: JVNDB-2021-004895 // CNNVD: CNNVD-202103-1449 // NVD: CVE-2021-1375

SOURCES

db:VULHUBid:VHN-374429
db:VULMONid:CVE-2021-1375
db:JVNDBid:JVNDB-2021-004895
db:CNNVDid:CNNVD-202103-1449
db:NVDid:CVE-2021-1375

LAST UPDATE DATE

2024-08-14T15:06:55.767000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-374429date:2021-03-30T00:00:00
db:VULMONid:CVE-2021-1375date:2021-03-30T00:00:00
db:JVNDBid:JVNDB-2021-004895date:2021-12-01T09:06:00
db:CNNVDid:CNNVD-202103-1449date:2021-03-31T00:00:00
db:NVDid:CVE-2021-1375date:2021-03-30T14:17:59.053

SOURCES RELEASE DATE

db:VULHUBid:VHN-374429date:2021-03-24T00:00:00
db:VULMONid:CVE-2021-1375date:2021-03-24T00:00:00
db:JVNDBid:JVNDB-2021-004895date:2021-12-01T00:00:00
db:CNNVDid:CNNVD-202103-1449date:2021-03-24T00:00:00
db:NVDid:CVE-2021-1375date:2021-03-24T21:15:12.100