CVE-2021-1361
published 2021-02-24CVE-2021-1361: A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in…
PriorityP263critical9.1CVSS 3.1
AVNACLPRNUINSUCNIHAH
EPSS
1.57%
72.7th percentile
A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode that are running Cisco NX-OS Software could allow an unauthenticated, remote attacker to create, delete, or overwrite arbitrary files with root privileges on the device. This vulnerability exists because TCP port 9075 is incorrectly configured to listen and respond to external connection requests. An attacker could exploit this vulnerability by sending crafted TCP packets to an IP address that is configured on a local interface on TCP port 9075. A successful exploit could allow the attacker to create, delete, or overwrite arbitrary files, including sensitive files that are related to the device configuration. For example, the attacker could add a user account without the device administrator knowing.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_nx-os_software | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for inbound TCP connections to port 9075 on any locally configured IP address of Cisco Nexus 3000/9000 devices; any external connection to this port is anomalous and indicative of exploitation attempts. ↗
- →Alert on unexpected user account creation on NX-OS devices, which may indicate successful exploitation resulting in unauthorized account addition. ↗
- →Detect unauthorized creation, deletion, or overwriting of files — especially device configuration files — on Cisco Nexus 3000/9000 switches running standalone NX-OS mode. ↗
- ·The vulnerability only affects Cisco Nexus 3000 and 9000 Series Switches running in standalone NX-OS mode; other deployment modes are not affected. ↗
- ·The service listens on all locally configured IP interfaces, meaning any reachable interface IP (not just management) can be targeted on TCP/9075. ↗
- ·A workaround exists in addition to the software fix; operators should consult the Cisco advisory for workaround details. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
nvdv2.09.4CRITICALAV:N/AC:L/Au:N/C:N/I:C/A:C
vendor_cisco9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9cw6-xmv9-q69p: A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches
ghsa_unreviewed·2022-05-24
CVE-2021-1361 [CRITICAL] CWE-552 GHSA-9cw6-xmv9-q69p: A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches
A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode that are running Cisco NX-OS Software could allow an unauthenticated, remote attacker to create, delete, or overwrite arbitrary files with root privileges on the device. This vulnerability exists because TCP port 9075 is incorrectly configured to listen and respond to external connection requests. An attacker could exploit this vulnerability by sending crafted TCP packets to an IP address that is configured on a local interface on TCP port 9075. A successful exploit could allow the attacker to create, delete, or overwrite arbitrary files, including sensitive files that are related to the device configuration. For exa
Cisco
Cisco NX-OS Software Unauthenticated Arbitrary File Actions Vulnerability
vendor_cisco·2021-02-24·CVSS 9.8
CVE-2021-1361 [CRITICAL] CWE-552 Cisco NX-OS Software Unauthenticated Arbitrary File Actions Vulnerability
Cisco NX-OS Software Unauthenticated Arbitrary File Actions Vulnerability
A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode that are running Cisco NX-OS Software could allow an unauthenticated, remote attacker to create, delete, or overwrite arbitrary files with root privileges on the device.
This vulnerability exists because TCP port 9075 is incorrectly configured to listen and respond to external connection requests. An attacker could exploit this vulnerability by sending crafted TCP packets to an IP address that is configured on a local interface on TCP port 9075. A successful exploit could allow the attacker to create, delete, or overwrite arbitrary files, inc
Cisco
Cisco NX-OS Software Unauthenticated Arbitrary File Actions Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-1361 Cisco NX-OS Software Unauthenticated Arbitrary File Actions Vulnerability
CVE-2021-1361: Cisco NX-OS Software Unauthenticated Arbitrary File Actions Vulnerability
A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode that are running Cisco NX-OS Software could allow an unauthenticated, remote attacker to create, delete, or overwrite arbitrary files with root privileges on the device. This vulnerability exists because TCP port 9075 is incorrectly configured to listen and respond to external connection requests. An attacker could exploit this vulnerability by sending crafted TCP packets to an IP address that is configured on a local interface on TCP port 9075. A successful exploit could allow the attacker to create, delete, or overwrite arbitra
No detection rules found.
No public exploits indexed.
Talos
Vulnerability Spotlight: Information disclosure vulnerability in D-LINK DIR-3040 mesh router
blogs_talos·2021-09-23·CVSS 9.8
[CRITICAL] Vulnerability Spotlight: Information disclosure vulnerability in D-LINK DIR-3040 mesh router
Dave McDaniel of Cisco Talos discovered this vulnerability.
Cisco Talos recently discovered an exploitable information disclosure vulnerability in the D-LINK DIR-3040 smart WiFi mesh router that could allow an adversary to eventually turn off the device or remove other connected devices from the mesh network.
The DIR-3040 is an AC3000-based wireless internet router that creates a mesh network for the user, allowing them to connect multiple devices in their environment, oftentimes at home. TALOS-2021-1361 (CVE-2021-21913) is a vulnerability that an attacker could trigger with a specially crafted network request. Eventually, the attacker could view sensitive information in the MQTT service, including the root password of the primary device.
Then, they could push the appropriate payloads t
Talos
Vulnerability Spotlight: Information disclosure vulnerability in D-LINK DIR-3040 mesh router
blogs_talos·2021-09-23·CVSS 9.8
[CRITICAL] Vulnerability Spotlight: Information disclosure vulnerability in D-LINK DIR-3040 mesh router
## Vulnerability Spotlight: Information disclosure vulnerability in D-LINK DIR-3040 mesh router
Dave McDaniel of Cisco Talos discovered this vulnerability.
Cisco Talos recently discovered an exploitable information disclosure vulnerability in the D-LINK DIR-3040 smart WiFi mesh router that could allow an adversary to eventually turn off the device or remove other connected devices from the mesh network.
The DIR-3040 is an AC3000-based wireless internet router that creates a mesh network for the user, allowing them to connect multiple devices in their environment, oftentimes at home. TALOS-2021-1361 (CVE-2021-21913) is a vulnerability that an attacker could trigger with a specially crafted network request. Eventually, the attacker could view sensitive information in the MQTT service, inc
2021-02-24
Published