CVE-2021-1136 — Improper Verification of Cryptographic Signature in Cisco IOS XR

CWE-347 — Improper Verification of Cryptographic Signature5 documents5 sources
Severity
6.7MEDIUMNVD
EPSS
0.0%
top 93.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOS XRCisco IOS XR Software
Timeline
PublishedFeb 4
Latest updateMay 24

Description

Multiple vulnerabilities in Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L software images, and Cisco IOS XR Software for the Cisco 8000 Series Routers could allow an authenticated, local attacker to execute unsigned code during the boot process on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/ios_xr7.1.0 — 7.2.1+2

🔴Vulnerability Details

2
GHSA
GHSA-hrm7-r95m-mcv4: Multiple vulnerabilities in Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L software images, and Cis↗2022-05-24
▶
CVEList
Cisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification Vulnerabilities↗2021-02-04
▶

📋Vendor Advisories

2
Chrome
Stable Channel Update for Desktop: CVE-2022-1136↗2022-03-29
▶
Cisco
Cisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification Vulnerabilities↗2021-02-03
▶
CVE-2021-1136 — Cisco IOS XR vulnerability | cvebase