Details of VAR-202103-0776

ID

VAR-202103-0776

CVE

CVE-2021-1439

TITLE

Cisco Aironet Series Access Points Classic buffer overflow vulnerability in software

Trust: 0.8

sources: JVNDB: JVNDB-2021-004968

DESCRIPTION

A vulnerability in the multicast DNS (mDNS) gateway feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of incoming mDNS traffic. An attacker could exploit this vulnerability by sending a crafted mDNS packet to an affected device through a wireless network that is configured in FlexConnect local switching mode or through a wired network on a configured mDNS VLAN. A successful exploit could allow the attacker to cause the access point (AP) to reboot, resulting in a DoS condition. Remote attackers can use this vulnerability to submit special requests, which can crash applications and cause denial of service attacks

Trust: 2.25

sources: NVD: CVE-2021-1439 // JVNDB: JVNDB-2021-004968 // CNVD: CNVD-2021-24464 // VULMON: CVE-2021-1439

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2021-24464

AFFECTED PRODUCTS

vendor:	cisco	model:	catalyst 9800	scope:	gte	version:	17.1	Trust: 1.0
vendor:	cisco	model:	aironet access point software	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	catalyst 9800	scope:	lt	version:	17.3.3	Trust: 1.0
vendor:	シスコシステムズ	model:	cisco catalyst 9800 シリーズ	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco aironet アクセスポイントソフトウェア	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	aironet	scope:	eq	version:	3800	Trust: 0.6
vendor:	cisco	model:	aironet	scope:	eq	version:	4800	Trust: 0.6
vendor:	cisco	model:	catalyst	scope:	eq	version:	9100	Trust: 0.6
vendor:	cisco	model:	catalyst iw6300	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	isr	scope:	eq	version:	1100	Trust: 0.6
vendor:	cisco	model:	esw6300	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	aironet access point software	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	aironet	scope:	eq	version:	1540	Trust: 0.6
vendor:	cisco	model:	aironet	scope:	eq	version:	1560	Trust: 0.6
vendor:	cisco	model:	aironet	scope:	eq	version:	1800	Trust: 0.6
vendor:	cisco	model:	aironet	scope:	eq	version:	2800	Trust: 0.6

sources: CNVD: CNVD-2021-24464 // JVNDB: JVNDB-2021-004968 // NVD: CVE-2021-1439

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-1439
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-1439
value:	HIGH
Trust: 1.0
NVD:	CVE-2021-1439
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2021-24464
value:	LOW
Trust: 0.6
CNNVD:	CNNVD-202103-1384
value:	HIGH
Trust: 0.6
VULMON:	CVE-2021-1439
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2021-1439
severity:	LOW
baseScore:	3.3
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2021-24464
severity:	LOW
baseScore:	3.3
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2021-1439
baseSeverity:	HIGH
baseScore:	7.4
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	4.0
version:	3.1
Trust: 2.0
NVD:	CVE-2021-1439
baseSeverity:	HIGH
baseScore:	7.4
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2021-24464 // VULMON: CVE-2021-1439 // JVNDB: JVNDB-2021-004968 // CNNVD: CNNVD-202103-1384 // NVD: CVE-2021-1439 // NVD: CVE-2021-1439

PROBLEMTYPE DATA

problemtype:	CWE-120	Trust: 1.0
problemtype:	Classic buffer overflow (CWE-120) [ Other ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-004968 // NVD: CVE-2021-1439

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202103-1384

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202103-1384

PATCH

title:	cisco-sa-aironet-mdns-dos-E6KwYuMx	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironet-mdns-dos-E6KwYuMx	Trust: 0.8
title:	Patch for Cisco Aironet Access Points Software Denial of Service Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/255731	Trust: 0.6
title:	Cisco Aironet Series Access Points Software Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=145036	Trust: 0.6
title:	Cisco: Cisco Aironet Access Points FlexConnect Multicast DNS Denial of Service Vulnerability	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-aironet-mdns-dos-E6KwYuMx	Trust: 0.1

sources: CNVD: CNVD-2021-24464 // VULMON: CVE-2021-1439 // JVNDB: JVNDB-2021-004968 // CNNVD: CNNVD-202103-1384

EXTERNAL IDS

db:	NVD	id:	CVE-2021-1439	Trust: 3.1
db:	JVNDB	id:	JVNDB-2021-004968	Trust: 0.8
db:	CNVD	id:	CNVD-2021-24464	Trust: 0.6
db:	CNNVD	id:	CNNVD-202103-1384	Trust: 0.6
db:	VULMON	id:	CVE-2021-1439	Trust: 0.1

sources: CNVD: CNVD-2021-24464 // VULMON: CVE-2021-1439 // JVNDB: JVNDB-2021-004968 // CNNVD: CNNVD-202103-1384 // NVD: CVE-2021-1439

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2021-1439	Trust: 2.0
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-aironet-mdns-dos-e6kwyumx	Trust: 1.7
url:	https://vigilance.fr/vulnerability/cisco-aironet-multiple-vulnerabilities-34939	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/120.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/198734	Trust: 0.1

sources: CNVD: CNVD-2021-24464 // VULMON: CVE-2021-1439 // JVNDB: JVNDB-2021-004968 // CNNVD: CNNVD-202103-1384 // NVD: CVE-2021-1439

SOURCES

db:	CNVD	id:	CNVD-2021-24464
db:	VULMON	id:	CVE-2021-1439
db:	JVNDB	id:	JVNDB-2021-004968
db:	CNNVD	id:	CNNVD-202103-1384
db:	NVD	id:	CVE-2021-1439

LAST UPDATE DATE

2024-08-14T15:42:56.243000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2021-24464	date:	2021-04-02T00:00:00
db:	VULMON	id:	CVE-2021-1439	date:	2021-03-31T00:00:00
db:	JVNDB	id:	JVNDB-2021-004968	date:	2021-12-02T09:13:00
db:	CNNVD	id:	CNNVD-202103-1384	date:	2021-04-01T00:00:00
db:	NVD	id:	CVE-2021-1439	date:	2023-11-07T03:28:19.093

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2021-24464	date:	2021-04-02T00:00:00
db:	VULMON	id:	CVE-2021-1439	date:	2021-03-24T00:00:00
db:	JVNDB	id:	JVNDB-2021-004968	date:	2021-12-02T00:00:00
db:	CNNVD	id:	CNNVD-202103-1384	date:	2021-03-24T00:00:00
db:	NVD	id:	CVE-2021-1439	date:	2021-03-24T20:15:14.977