Sign-up

ID

VAR-202109-0611


CVE

CVE-2021-34722


TITLE

Cisco IOS XR  in software  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-011597

DESCRIPTION

Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory. Cisco IOS XR The software has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Cisco IOS XR Software is a unique self-healing and self-defense operating system. It not only supports round-the-clock operation, but also continuously expands and adds new services or new features. The vulnerability stems from the program's failure to verify the command parameters correctly. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 2.79

sources: NVD: CVE-2021-34722 // JVNDB: JVNDB-2021-011597 // CNVD: CNVD-2021-70106 // CNNVD: CNNVD-202104-975 // VULMON: CVE-2021-34722

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-70106

AFFECTED PRODUCTS

vendor:ciscomodel:ios xrscope:gteversion:7.1.1

Trust: 1.0

vendor:ciscomodel:ios xrscope:gteversion:7.4.0

Trust: 1.0

vendor:ciscomodel:ios xrscope:ltversion:7.3.2

Trust: 1.0

vendor:ciscomodel:ios xrscope:ltversion:7.4.1

Trust: 1.0

vendor:シスコシステムズmodel:cisco ios xrscope:eqversion: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco ios xrscope: - version: -

Trust: 0.8

vendor:ciscomodel:ios xrscope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2021-70106 // JVNDB: JVNDB-2021-011597 // NVD: CVE-2021-34722

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-34722
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2021-34722
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-34722
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2021-70106
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202109-394
value: MEDIUM

Trust: 0.6

VULMON: CVE-2021-34722
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-34722
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2021-70106
severity: MEDIUM
baseScore: 6.5
vectorString: AV:L/AC:L/AU:M/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 2.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-34722
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2021-34722
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-70106 // VULMON: CVE-2021-34722 // JVNDB: JVNDB-2021-011597 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202109-394 // NVD: CVE-2021-34722 // NVD: CVE-2021-34722

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

problemtype:OS Command injection (CWE-78) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-011597 // NVD: CVE-2021-34722

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202109-394

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:cisco-sa-iosxr-cmd-inj-wbZKvPxcurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc

Trust: 0.8

title:Patch for Cisco IOS XR Software command injection vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/290431

Trust: 0.6

title:Cisco IOS XR Fixes for operating system command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=162591

Trust: 0.6

title:Cisco: Cisco IOS XR Software Command Injection Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-iosxr-cmd-inj-wbZKvPxc

Trust: 0.1

sources: CNVD: CNVD-2021-70106 // VULMON: CVE-2021-34722 // JVNDB: JVNDB-2021-011597 // CNNVD: CNNVD-202109-394

EXTERNAL IDS

db:NVDid:CVE-2021-34722

Trust: 3.9

db:JVNDBid:JVNDB-2021-011597

Trust: 0.8

db:CNVDid:CNVD-2021-70106

Trust: 0.6

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:AUSCERTid:ESB-2021.3022.4

Trust: 0.6

db:AUSCERTid:ESB-2021.3022.5

Trust: 0.6

db:AUSCERTid:ESB-2021.3022.2

Trust: 0.6

db:AUSCERTid:ESB-2021.3022.3

Trust: 0.6

db:CS-HELPid:SB2021090909

Trust: 0.6

db:CNNVDid:CNNVD-202109-394

Trust: 0.6

db:VULMONid:CVE-2021-34722

Trust: 0.1

sources: CNVD: CNVD-2021-70106 // VULMON: CVE-2021-34722 // JVNDB: JVNDB-2021-011597 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202109-394 // NVD: CVE-2021-34722

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-iosxr-cmd-inj-wbzkvpxc

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-34722

Trust: 2.0

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://vigilance.fr/vulnerability/cisco-ios-xr-code-execution-via-command-injection-36353

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3022.5

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021090909

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3022.2

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3022.4

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3022.3

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/78.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2021-70106 // VULMON: CVE-2021-34722 // JVNDB: JVNDB-2021-011597 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202109-394 // NVD: CVE-2021-34722

SOURCES

db:CNVDid:CNVD-2021-70106
db:VULMONid:CVE-2021-34722
db:JVNDBid:JVNDB-2021-011597
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202109-394
db:NVDid:CVE-2021-34722

LAST UPDATE DATE

2024-08-14T12:15:09.143000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-70106date:2021-09-11T00:00:00
db:VULMONid:CVE-2021-34722date:2021-09-21T00:00:00
db:JVNDBid:JVNDB-2021-011597date:2022-08-05T07:29:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202109-394date:2021-10-21T00:00:00
db:NVDid:CVE-2021-34722date:2023-11-07T03:36:12.397

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-70106date:2021-09-11T00:00:00
db:VULMONid:CVE-2021-34722date:2021-09-09T00:00:00
db:JVNDBid:JVNDB-2021-011597date:2022-08-05T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202109-394date:2021-09-08T00:00:00
db:NVDid:CVE-2021-34722date:2021-09-09T05:15:11.770