Details of VAR-202110-1297

ID

VAR-202110-1297

CVE

CVE-2021-34756

TITLE

Cisco Firepower Threat Defense in software OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-018457

DESCRIPTION

Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory. (DoS) It may be in a state

Trust: 1.71

sources: NVD: CVE-2021-34756 // JVNDB: JVNDB-2021-018457 // VULHUB: VHN-394998

AFFECTED PRODUCTS

vendor:	cisco	model:	firepower threat defense	scope:	gte	version:	7.0.0	Trust: 1.0
vendor:	cisco	model:	firepower threat defense	scope:	lt	version:	7.0.1	Trust: 1.0
vendor:	cisco	model:	firepower threat defense	scope:	lt	version:	6.7.0.3	Trust: 1.0
vendor:	cisco	model:	firepower threat defense	scope:	gte	version:	6.4.0	Trust: 1.0
vendor:	cisco	model:	sourcefire defense center	scope:	eq	version:	6.3.0	Trust: 1.0
vendor:	cisco	model:	firepower threat defense	scope:	lt	version:	6.4.0.13	Trust: 1.0
vendor:	cisco	model:	sourcefire defense center	scope:	eq	version:	6.1.0	Trust: 1.0
vendor:	cisco	model:	firepower threat defense	scope:	gte	version:	6.6.0	Trust: 1.0
vendor:	cisco	model:	firepower management center virtual appliance	scope:	eq	version:	6.3.0	Trust: 1.0
vendor:	cisco	model:	firepower management center virtual appliance	scope:	eq	version:	6.1.0	Trust: 1.0
vendor:	cisco	model:	firepower management center virtual appliance	scope:	eq	version:	6.6.1	Trust: 1.0
vendor:	cisco	model:	sourcefire defense center	scope:	eq	version:	6.6.1	Trust: 1.0
vendor:	cisco	model:	firepower management center virtual appliance	scope:	eq	version:	6.2.3	Trust: 1.0
vendor:	cisco	model:	firepower threat defense	scope:	lt	version:	6.6.5	Trust: 1.0
vendor:	cisco	model:	sourcefire defense center	scope:	eq	version:	6.2.0	Trust: 1.0
vendor:	cisco	model:	sourcefire defense center	scope:	eq	version:	6.2.3	Trust: 1.0
vendor:	cisco	model:	firepower threat defense	scope:	gte	version:	6.7.0	Trust: 1.0
vendor:	cisco	model:	firepower management center virtual appliance	scope:	eq	version:	7.0.0	Trust: 1.0
vendor:	cisco	model:	firepower management center virtual appliance	scope:	eq	version:	6.2.0	Trust: 1.0
vendor:	cisco	model:	sourcefire defense center	scope:	eq	version:	7.0.0	Trust: 1.0
vendor:	cisco	model:	sourcefire defense center	scope:	eq	version:	7.1.0	Trust: 1.0
vendor:	cisco	model:	firepower management center virtual appliance	scope:	eq	version:	7.1.0	Trust: 1.0
vendor:	cisco	model:	firepower management center virtual appliance	scope:	eq	version:	6.4.0	Trust: 1.0
vendor:	cisco	model:	sourcefire defense center	scope:	eq	version:	6.4.0	Trust: 1.0
vendor:	cisco	model:	sourcefire defense center	scope:	eq	version:	6.5.0	Trust: 1.0
vendor:	cisco	model:	sourcefire defense center	scope:	eq	version:	6.4.0.11	Trust: 1.0
vendor:	cisco	model:	firepower management center virtual appliance	scope:	eq	version:	6.6.0	Trust: 1.0
vendor:	cisco	model:	sourcefire defense center	scope:	eq	version:	6.6.0	Trust: 1.0
vendor:	cisco	model:	sourcefire defense center	scope:	eq	version:	6.7.0	Trust: 1.0
vendor:	cisco	model:	firepower management center virtual appliance	scope:	eq	version:	6.5.0	Trust: 1.0
vendor:	cisco	model:	firepower management center virtual appliance	scope:	eq	version:	6.4.0.11	Trust: 1.0
vendor:	cisco	model:	firepower management center virtual appliance	scope:	eq	version:	6.7.0	Trust: 1.0
vendor:	シスコシステムズ	model:	cisco sourcefire defense center	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco firepower management center virtual appliance	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco firepower threat defense ソフトウェア	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-018457 // NVD: CVE-2021-34756

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-34756
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-34756
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2021-34756
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202110-2014
value:	HIGH
Trust: 0.6
VULHUB:	VHN-394998
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2021-34756
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-394998
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-34756
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-34756
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2021-34756
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-394998 // JVNDB: JVNDB-2021-018457 // CNNVD: CNNVD-202110-2014 // NVD: CVE-2021-34756 // NVD: CVE-2021-34756

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.1
problemtype:	CWE-20	Trust: 1.0

sources: VULHUB: VHN-394998 // NVD: CVE-2021-34756

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202110-2014

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202110-2014

PATCH

title:	cisco-sa-ftd-cmdinject-FmzsLN8	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-cmdinject-FmzsLN8	Trust: 0.8
title:	Cisco Firepower Threat Defense Fixes for command injection vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=168745	Trust: 0.6

sources: JVNDB: JVNDB-2021-018457 // CNNVD: CNNVD-202110-2014

EXTERNAL IDS

db:	NVD	id:	CVE-2021-34756	Trust: 3.3
db:	JVNDB	id:	JVNDB-2021-018457	Trust: 0.8
db:	CNNVD	id:	CNNVD-202110-2014	Trust: 0.7
db:	CS-HELP	id:	SB2021102910	Trust: 0.6
db:	AUSCERT	id:	ESB-2021.3597	Trust: 0.6
db:	VULHUB	id:	VHN-394998	Trust: 0.1

sources: VULHUB: VHN-394998 // JVNDB: JVNDB-2021-018457 // CNNVD: CNNVD-202110-2014 // NVD: CVE-2021-34756

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ftd-cmdinject-fmzsln8	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2021-34756	Trust: 1.4
url:	https://www.cybersecurity-help.cz/vdb/sb2021102910	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.3597	Trust: 0.6

sources: VULHUB: VHN-394998 // JVNDB: JVNDB-2021-018457 // CNNVD: CNNVD-202110-2014 // NVD: CVE-2021-34756

SOURCES

db:	VULHUB	id:	VHN-394998
db:	JVNDB	id:	JVNDB-2021-018457
db:	CNNVD	id:	CNNVD-202110-2014
db:	NVD	id:	CVE-2021-34756

LAST UPDATE DATE

2024-08-14T13:53:52.423000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-394998	date:	2022-10-24T00:00:00
db:	JVNDB	id:	JVNDB-2021-018457	date:	2023-06-15T04:59:00
db:	CNNVD	id:	CNNVD-202110-2014	date:	2022-10-25T00:00:00
db:	NVD	id:	CVE-2021-34756	date:	2023-11-07T03:36:19.103

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-394998	date:	2021-10-27T00:00:00
db:	JVNDB	id:	JVNDB-2021-018457	date:	2023-06-15T00:00:00
db:	CNNVD	id:	CNNVD-202110-2014	date:	2021-10-27T00:00:00
db:	NVD	id:	CVE-2021-34756	date:	2021-10-27T19:15:07.940