CVE-2021-1352
published 2021-03-24CVE-2021-1352: A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a…
PriorityP427medium6.5CVSS 3.1
AVAACLPRNUINSUCNINAH
EPSS
0.40%
32.5th percentile
A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of DECnet traffic that is received by an affected device. An attacker could exploit this vulnerability by sending DECnet traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Affected
91 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_ios_xe_software | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.02.9LOWAV:A/AC:M/Au:N/C:N/I:N/A:P
vendor_cisco7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vcq5-wh47-842g: A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker t
ghsa_unreviewed·2022-05-24
CVE-2021-1352 [MEDIUM] CWE-119 GHSA-vcq5-wh47-842g: A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker t
A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of DECnet traffic that is received by an affected device. An attacker could exploit this vulnerability by sending DECnet traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
CISA ICS
Rockwell Automation Stratix Switches
cisa_ics·2021-04-20·CVSS 7.8
[HIGH] Rockwell Automation Stratix Switches
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Rockwell Automation Stratix Switches
Last RevisedApril 20, 2021
Alert CodeICSA-21-110-02
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Exploitable remotely/ Low attack complexity
- Vendor: Rockwell Automation
- Equipment: Stratix Switches
- Vulnerabilities: Insufficiently Protected Credentials, Insufficient Verification of Data Authenticity, Use of Out-of-Range Pointer Offset, Insertion of Sensitive Information Into Log File, Command Injection, Improper Input Validation
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities may result in denial-of-serv
Cisco
Cisco IOS XE Software DECnet Phase IV/OSI Denial of Service Vulnerability
vendor_cisco·2021-03-24·CVSS 7.4
CVE-2021-1352 [HIGH] CWE-823 Cisco IOS XE Software DECnet Phase IV/OSI Denial of Service Vulnerability
Cisco IOS XE Software DECnet Phase IV/OSI Denial of Service Vulnerability
A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device.
The vulnerability is due to insufficient input validation of DECnet traffic that is received by an affected device. An attacker could exploit this vulnerability by sending DECnet traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:https
Cisco
Cisco IOS XE Software DECnet Phase IV/OSI Denial of Service Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-1352 Cisco IOS XE Software DECnet Phase IV/OSI Denial of Service Vulnerability
CVE-2021-1352: Cisco IOS XE Software DECnet Phase IV/OSI Denial of Service Vulnerability
A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of DECnet traffic that is received by an affected device. An attacker could exploit this vulnerability by sending DECnet traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-823, CWE-823
Bug IDs: CSCvv51476
No detection rules found.
No public exploits indexed.
Talos
Vulnerability Spotlight: Use-after-free condition in Google Chrome could lead to code execution
blogs_talos·2021-12-01·CVSS 8.8
CVE-2021-30625 [HIGH] Vulnerability Spotlight: Use-after-free condition in Google Chrome could lead to code execution
Marcin Towalski of Cisco Talos discovered this vulnerability.
Cisco Talos recently discovered an exploitable use-after-free vulnerability in Google Chrome.
Google Chrome is a cross-platform web browser — and Chromium is the open-source version of the browser that other software developers use to build their browsers, as well. This specific vulnerability exists in Blink, the main DOM parsing and rendering engine at the core of Chromium. TALOS-2021-1352 (CVE-2021-30625) is a use-after-free vulnerability that triggers if the user opens a specially crafted web page in Chrome. That page could trigger the reuse of previously freed memory, which can lead to arbitrary code execution.
Cisco Talos worked with Google to ensure that this issue is resolved and an update is available for affected cus
Talos
Vulnerability Spotlight: Use-after-free condition in Google Chrome could lead to code execution
blogs_talos·2021-12-01·CVSS 8.8
[HIGH] Vulnerability Spotlight: Use-after-free condition in Google Chrome could lead to code execution
## Vulnerability Spotlight: Use-after-free condition in Google Chrome could lead to code execution
Marcin Towalski of Cisco Talos discovered this vulnerability.
Cisco Talos recently discovered an exploitable use-after-free vulnerability in Google Chrome.
Google Chrome is a cross-platform web browser — and Chromium is the open-source version of the browser that other software developers use to build their browsers, as well. This specific vulnerability exists in Blink, the main DOM parsing and rendering engine at the core of Chromium. TALOS-2021-1352 (CVE-2021-30625) is a use-after-free vulnerability that triggers if the user opens a specially crafted web page in Chrome. That page could trigger the reuse of previously freed memory, which can lead to arbitrary code execution.
Cisco Talos
2021-03-24
Published