Resource exhaustion in Cisco Systems, Inc products - CVE-2021-1220

Vulnerability identifier: #VU51725

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-1220

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the web UI of Cisco IOS XE Software. A remote authenticated user can send specially crafted HTTP request to the web UI and cause the web management software to hang and consume all available vty lines, preventing new session establishment.

Cisco 2600 Series Multiservice Platforms
Cisco ASR 1000 Series Aggregation Services Routers
Cisco 1000 Series Integrated Services Routers
Cisco Catalyst 9300 Series Switches
Cisco Catalyst 9500 Series Switches
Cisco Catalyst 9200 Series Switches
Allen-Bradley Stratix 5400 Industrial Ethernet Switches
Allen-Bradley Stratix 5410 Industrial Distribution Switches
Allen-Bradley Stratix 5700 Industrial Managed Ethernet Switches
Allen-Bradley Stratix 8000 Modular Managed Ethernet Switches
Stratix 5800
Cisco IOS XE

Install updates from vendor's website.

Stratix 5800 - update to 17.04.01

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xe-webui-dos-z9yqYQAn
• https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu99729

• Denial of service in Cisco IOS XE Software Web UI
• Multiple vulnerabilities in Rockwell Automation Stratix Switches