SB2021110417 - Multiple vulnerabilities in Cisco Catalyst PON Series Switches



SB2021110417 - Multiple vulnerabilities in Cisco Catalyst PON Series Switches

Published: November 4, 2021

Security Bulletin ID SB2021110417
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Use of hard-coded credentials (CVE-ID: CVE-2021-34795)

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to an unintentional debugging credential that exists on the device. A remote unauthenticated attacker can access the affected system using the hard-coded credentials.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2021-40112)

The vulnerability allows a remote attacker to modify the configuration of the device.

The vulnerability exists due to improper HTTPS input validation. A remote attacker can send a specially crafted HTTPS request to the web management interface and modify the configuration.


3) Command Injection (CVE-ID: CVE-2021-40113)

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the web-based management interface. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.