SB2021032911 - Improper Verification of Cryptographic Signature in Cisco IOS XE
Published: March 29, 2021
Security Bulletin ID
SB2021032911
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2021-1376)
CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to compromise the target system.
The vulnerability exists in the fast reload feature due to an improper check on the area of code that manages the verification of boot configuration files during the initial fast reload boot process. A local administrator can execute arbitrary code on the underlying operating system.
Remediation
Install update from vendor's website.