IPV6 ACL bypass in Cisco IOS XR and Cisco NX-OS Software

1) Improper access control

EUVDB-ID: #VU50381

Risk: Medium

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-1389

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions when processing IPv6 traffic in Cisco IOS XR Software and Cisco NX-OS Software for certain Cisco devices. A remote attacker can bypass implemented ACLs with specially crafted IPv6 packets.

this vulnerability affected the following Cisco devices if they were running a vulnerable release of Cisco IOS XR Software or Cisco NX-OS Software and had IPv6 ACL configured:

• Network Convergence System (NCS) 540 Series Routers
• NCS 560 Series Routers
• NCS 5500 Series
• Nexus 3600 Platform Switches
• Nexus 9500 R-Series Switching Platforms

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco IOS XR: before 7.2.0

Cisco Nexus 9000 Series Switches: before 10.1.1

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv6-acl-CHgdYk8j
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm55638
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCvv45698

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.