Details of VAR-202103-0549

ID

VAR-202103-0549

CVE

CVE-2021-1376

TITLE

plural Cisco Catalyst Runs on series switches Cisco IOS XE Digital Signature Verification Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-004896

DESCRIPTION

Multiple vulnerabilities in the fast reload feature of Cisco IOS XE Software running on Cisco Catalyst 3850, Cisco Catalyst 9300, and Cisco Catalyst 9300L Series Switches could allow an authenticated, local attacker to either execute arbitrary code on the underlying operating system, install and boot a malicious software image, or execute unsigned binaries on an affected device. These vulnerabilities are due to improper checks performed by system boot routines. To exploit these vulnerabilities, the attacker would need privileged access to the CLI of the device. A successful exploit could allow the attacker to either execute arbitrary code on the underlying operating system or execute unsigned code and bypass the image verification check part of the secure boot process. For more information about these vulnerabilities, see the Details section of this advisory. plural Cisco Catalyst Runs on series switches Cisco IOS XE Exists in a digital signature validation vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Cisco IOS XE is an operating system developed by Cisco for its network equipment

Trust: 1.8

sources: NVD: CVE-2021-1376 // JVNDB: JVNDB-2021-004896 // VULHUB: VHN-374430 // VULMON: CVE-2021-1376

AFFECTED PRODUCTS

vendor:	cisco	model:	ios xe	scope:	eq	version:	17.2.1a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.3a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.9.4	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.1.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.9.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.6.5	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.9.3a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.6.4a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.10.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.11.2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.6.3	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.6.4	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.1.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.6.4s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.9.6	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.6.6	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.10.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.11.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.6.2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.9.3s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.2.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.8.1a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.11.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.9.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.1c	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.2s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.6.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.11.1b	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.2t	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.9.2s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.9.5	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.1.2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.6.7	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.8.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.5.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.4a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.9.3	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	17.1.1t	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.5.1a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.8.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.10.1e	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.9.2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.4	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.11.1c	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.6.8	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.3	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.12.3s	Trust: 1.0
vendor:	シスコシステムズ	model:	cisco ios xe	scope:	eq	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco ios xe	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-004896 // NVD: CVE-2021-1376

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-1376
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-1376
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2021-1376
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202103-1448
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-374430
value:	HIGH
Trust: 0.1
VULMON:	CVE-2021-1376
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2021-1376
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-374430
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

ykramarz@cisco.com:	CVE-2021-1376
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.8
impactScore:	5.9
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2021-1376
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.8
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: VULHUB: VHN-374430 // VULMON: CVE-2021-1376 // JVNDB: JVNDB-2021-004896 // CNNVD: CNNVD-202103-1448 // NVD: CVE-2021-1376 // NVD: CVE-2021-1376

PROBLEMTYPE DATA

problemtype:	CWE-347	Trust: 1.1
problemtype:	Improper verification of digital signatures (CWE-347) [ Other ]	Trust: 0.8

sources: VULHUB: VHN-374430 // JVNDB: JVNDB-2021-004896 // NVD: CVE-2021-1376

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202103-1448

TYPE

data forgery

Trust: 0.6

sources: CNNVD: CNNVD-202103-1448

PATCH

title:	cisco-sa-fast-Zqr6DD5	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fast-Zqr6DD5	Trust: 0.8
title:	Cisco IOS XE Repair measures for data forgery problem vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=145730	Trust: 0.6
title:	Cisco: Cisco IOS XE Software Fast Reload Vulnerabilities	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-fast-Zqr6DD5	Trust: 0.1

sources: VULMON: CVE-2021-1376 // JVNDB: JVNDB-2021-004896 // CNNVD: CNNVD-202103-1448

EXTERNAL IDS

db:	NVD	id:	CVE-2021-1376	Trust: 2.6
db:	JVNDB	id:	JVNDB-2021-004896	Trust: 0.8
db:	CNNVD	id:	CNNVD-202103-1448	Trust: 0.7
db:	VULHUB	id:	VHN-374430	Trust: 0.1
db:	VULMON	id:	CVE-2021-1376	Trust: 0.1

sources: VULHUB: VHN-374430 // VULMON: CVE-2021-1376 // JVNDB: JVNDB-2021-004896 // CNNVD: CNNVD-202103-1448 // NVD: CVE-2021-1376

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-fast-zqr6dd5	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2021-1376	Trust: 1.4
url:	https://vigilance.fr/vulnerability/cisco-ios-ios-xe-multiple-vulnerabilities-34940	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/347.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/198730	Trust: 0.1

sources: VULHUB: VHN-374430 // VULMON: CVE-2021-1376 // JVNDB: JVNDB-2021-004896 // CNNVD: CNNVD-202103-1448 // NVD: CVE-2021-1376

SOURCES

db:	VULHUB	id:	VHN-374430
db:	VULMON	id:	CVE-2021-1376
db:	JVNDB	id:	JVNDB-2021-004896
db:	CNNVD	id:	CNNVD-202103-1448
db:	NVD	id:	CVE-2021-1376

LAST UPDATE DATE

2024-08-14T14:18:34.014000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-374430	date:	2021-03-30T00:00:00
db:	VULMON	id:	CVE-2021-1376	date:	2021-03-30T00:00:00
db:	JVNDB	id:	JVNDB-2021-004896	date:	2021-12-01T09:06:00
db:	CNNVD	id:	CNNVD-202103-1448	date:	2021-03-31T00:00:00
db:	NVD	id:	CVE-2021-1376	date:	2021-03-30T14:34:54.303

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-374430	date:	2021-03-24T00:00:00
db:	VULMON	id:	CVE-2021-1376	date:	2021-03-24T00:00:00
db:	JVNDB	id:	JVNDB-2021-004896	date:	2021-12-01T00:00:00
db:	CNNVD	id:	CNNVD-202103-1448	date:	2021-03-24T00:00:00
db:	NVD	id:	CVE-2021-1376	date:	2021-03-24T21:15:12.177