Vulnerability identifier: #VU51725

Vulnerability risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-1220

CWE-ID: CWE-400

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco 2600 Series Multiservice Platforms
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco ASR 1000 Series Aggregation Services Routers
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco 1000 Series Integrated Services Routers
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Catalyst 9300 Series Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Catalyst 9500 Series Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Catalyst 9200 Series Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco IOS XE
Operating systems & Components / Operating system

Vendor: Cisco Systems, Inc

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the web UI of Cisco IOS XE Software. A remote authenticated user can send specially crafted HTTP request to the web UI and cause the web management software to hang and consume all available vty lines, preventing new session establishment.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Cisco 2600 Series Multiservice Platforms: All versions

Cisco ASR 1000 Series Aggregation Services Routers: All versions

Cisco 1000 Series Integrated Services Routers: All versions

Cisco Catalyst 9300 Series Switches: All versions

Cisco Catalyst 9500 Series Switches: All versions

Cisco Catalyst 9200 Series Switches: All versions

Cisco IOS XE: 17.2

---

External links
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xe-webui-dos-z9yqYQAn
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu99729

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.