CVE-2021-1241 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Cisco Sd-wan Solution

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-20 — Improper Input ValidationCWE-787 — Out-of-bounds WriteCWE-1241 — Use of Predictable Algorithm in Random Number GeneratorCWE-330 — Use of Insufficiently Random ValuesCWE-331 — Insufficient Entropy7 documents6 sources
Severity
7.5HIGHNVD
CNA8.6
EPSS
0.6%
top 30.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Sd-wan SolutionCisco Sd-wan Firmware
Timeline
PublishedJan 20
Latest updateNov 16

Description

Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDcisco/sd-wan_firmware10 versions+9

🔴Vulnerability Details

4
GHSA
Insufficient Entropy in PHPServerMon PRNG↗2022-11-16
▶
GHSA
PHPServerMon PRNG has Insufficient Entropy↗2022-11-16
▶
GHSA
GHSA-h93f-69cr-g7fq: Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against a↗2022-05-24
▶
CVEList
Cisco SD-WAN Denial of Service Vulnerabilities↗2021-01-20
▶

📋Vendor Advisories

1
Cisco
Cisco SD-WAN Denial of Service Vulnerabilities↗2021-01-20
▶

🕵️Threat Intelligence

1
Talos
Vulnerability Spotlight: Multiple vulnerabilities in Trend Micro Home Network Security Station↗2021-05-24
▶
CVE-2021-1241 — Cisco Sd-wan Solution vulnerability | cvebase