Improper access control in multiple Cisco products

1) Improper access control

EUVDB-ID: #VU67769

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-27861

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to insufficient validation of SNAP/LLC Ethernet frames. A remote attacker on the local network can bypass the FHS feature of the target device.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Catalyst 6500 Series Switches: All versions

Cisco Catalyst 6800 Series Switches: All versions

Catalyst Digital Building Series Switches: All versions

Micro Switches: All versions

IOS XR Routers configured with L2 Transport services: All versions

Cisco Merak MS210: All versions

Cisco Merak MS225: All versions

Cisco Merak MS250: All versions

Cisco Merak MS350: All versions

Cisco Merak MS355: All versions

Cisco Merak MS410: All versions

Cisco Merak MS420: All versions

Cisco Merak MS425: All versions

Cisco Merak MS450: All versions

Cisco Nexus 3000 Series Switches: All versions

Nexus 5500 Platform Switches: All versions

Nexus 5600 Platform Switches: All versions

Nexus 6000 Series Switches: All versions

Nexus 7000 Series Switches: All versions

Cisco Nexus 9000 Series Switches: All versions

Cisco 250 Series Smart Switches: All versions

Cisco 350 Series Managed Switches: All versions

Cisco 350X Series Stackable Managed Switches: All versions

Cisco 550X Series Stackable Managed Switches: All versions

CPE2.3

• cpe:2.3:a:cisco_systems:catalyst_6500_series_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_catalyst_6800_series_switches:*:*:*:*:*:*:*:*
• cpe:2.3:a:cisco_systems:catalyst_digital_building_series_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:micro_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:ios_xr_routers_configured_with_l2_transport_services:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_merak_ms210:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_merak_ms225:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_merak_ms250:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_merak_ms350:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_merak_ms355:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_merak_ms410:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_merak_ms420:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_merak_ms425:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_merak_ms450:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_3000_series_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:nexus_5500_platform_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:nexus_5600_platform_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:nexus_6000_series_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:nexus_7000_series_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_9000_series_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_250_series_smart_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_350_series_managed_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_350x_series_stackable_managed_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_550x_series_stackable_managed_switches:*:*:*:*:*:*:*:*

External links

https://blog.champtar.fr/VLAN0_LLC_SNAP/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.