CVE-2021-1403 — Insufficient Verification of Data Authenticity in Cisco IOS XE Software

CWE-345 — Insufficient Verification of Data Authenticity CWE-1021 — UI Misrepresentation / Clickjacking6 documents5 sources

Severity

7.4HIGHNVD

EPSS

0.1%

top 70.75%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco IOS XE Software Cisco IOS XE

Timeline

PublishedMar 24

Latest updateMay 24

Description

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site WebSocket hijacking (CSWSH) attack and cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient HTTP protections in the web UI on an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the web UI to follow a crafted link. A successful exploit could allow the attacke…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:HExploitability: 2.8 | Impact: 4.0

Affected Packages2 packages

▶CVEListV5cisco/cisco_ios_xe_softwaren/a

▶NVDcisco/ios_xe123 versions+122

🔴Vulnerability Details

GHSA

GHSA-65hw-5pjx-qj9v: A vulnerability in the web UI feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site WebSocket hijac↗2022-05-24

▶

CVEList

Cisco IOS XE Software Web UI Cross-Site WebSocket Hijacking Vulnerability↗2021-03-24

▶

📋Vendor Advisories

Cisco

Cisco IOS XE Software Web UI Cross-Site WebSocket Hijacking Vulnerability↗2021-03-24

▶

🕵️Threat Intelligence

Talos

Vulnerability Spotlight: Vulnerabilities in Moxa MXView could allow attacker to view sensitive information, bypass login↗2022-02-11

▶

Talos

Vulnerability Spotlight: Vulnerabilities in Moxa MXView could allow attacker to view sensitive information, bypass login↗2022-02-11

▶