CVE-2021-34699: A vulnerability in the TrustSec CLI parser of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a...

Summary

A vulnerability in the TrustSec CLI parser of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. This vulnerability is due to an improper interaction between the web UI and the CLI parser. An attacker could exploit this vulnerabil...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cisco	ios	12.2\(6\)i1 15.0\(1\)sy 15.0\(1\)sy1 15.0\(1\)sy2 15.0\(1\)sy3 15.0\(1\)sy4 15.0\(1\)sy5 15.0\(1\)sy6 15.0\(1\)sy7 15.0\(1\)sy7a 15.0\(1\)sy8 15.0\(1\)sy9 503 more version ranges `cpe:2.3:o:cisco:ios:12.2\(6\)i1:::::::*`
cisco	ios_xe	3.3.0se 3.3.0xo 3.3.1se 3.3.1xo 3.3.2se 3.3.2xo 3.3.3se 3.3.4se 3.3.5se 3.5.0e 3.5.1e 3.5.2e 307 more version ranges `cpe:2.3:o:cisco:ios_xe:3.3.0se:::::::*`

Original advisory text

A vulnerability in the TrustSec CLI parser of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a...

A vulnerability in the TrustSec CLI parser of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. This vulnerability is due to an improper interaction between the web UI and the CLI parser. An attacker could exploit this vulnerability by requesting a particular CLI command to be run through the web UI. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-t... Vendor Advisory