Insufficient Session Expiration in Cisco Systems, Inc products - CVE-2021-34739

Vulnerability identifier: #VU57958

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2021-34739

CWE-ID: CWE-613

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Cisco Systems, Inc

Affected software:
Cisco 250 Series Smart Switches
Cisco 350 Series Managed Switches
Cisco 350X Series Stackable Managed Switches
Cisco 550X Series Stackable Managed Switches
Cisco ESW2 Series Advanced Switches
Cisco Small Business 200 Series Smart Switches
Cisco Small Business 300 Series Managed Switches
Cisco Small Business 500 Series Stackable Managed Switches

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient expiration of session credentials. A remote non-authenticated attacker can obtain or guess session token, gain unauthorized access to session that belongs to another user and access the web-based management interface with administrator privileges.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-switches-tokens-UzwpR4e5