Out-of-bounds write in Cisco Systems, Inc products - CVE-2021-1368

Vulnerability identifier: #VU50951

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-1368

CWE-ID: CWE-787

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in the Unidirectional Link Detection (UDLD) feature. A remote attacker on the local network can trigger out-of-bounds write and execute arbitrary code on the target system.

Cisco Firepower 4100 Series Next-Generation Firewall
Firepower 9300 Series Security Appliances
UCS 6200 Series Fabric Interconnects
UCS 6300 Series Fabric Interconnects
UCS 6400 Series Fabric Interconnects
Cisco Nexus 9000 Series Switches NX-OS Mode
Cisco Nexus 3000 Series Switches
Cisco MDS 9000 Series Multilayer Switches
Nexus 7000 Series Switches
Nexus 5600 Platform Switches
Nexus 6000 Series Switches
Nexus 5500 Platform Switches

Install updates from vendor's website.

Cisco Firepower 4100 Series Next-Generation Firewall - addressed in versions 2.8.1.143, 2.9.1.135
Firepower 9300 Series Security Appliances - addressed in versions 2.8.1.143, 2.9.1.135
UCS 6200 Series Fabric Interconnects - addressed in versions 4.0.4l, 4.1.2c
UCS 6300 Series Fabric Interconnects - addressed in versions 4.0.4l, 4.1.2c
UCS 6400 Series Fabric Interconnects - addressed in versions 4.0.4l, 4.1.2c
Cisco Nexus 9000 Series Switches NX-OS Mode - update to 7.0.3 I7.9
Cisco Nexus 3000 Series Switches - update to 7.0.3 I7.9
Cisco MDS 9000 Series Multilayer Switches - update to 7.0.3 I7.9
Nexus 7000 Series Switches - addressed in versions 7.3.5 D1.1, 8.2.5
Nexus 5600 Platform Switches - update to 7.3.8 N1.1
Nexus 6000 Series Switches - update to 7.3.8 N1.1
Nexus 5500 Platform Switches - update to 7.3.8 N1.1

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-udld-rce-xetH6w35

• Out-of-bounds write in Cisco Unidirectional Link Detection feature in FXOS and NX-OS Software