CVE-2021-1424
published 2024-11-18CVE-2021-1424: A vulnerability in the ipsecmgr process of Cisco ASR 5000 Series Software (StarOS) could allow an unauthenticated, remote attacker to cause a denial of service…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.78%
51.6th percentile
A vulnerability in the ipsecmgr process of Cisco ASR 5000 Series Software (StarOS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
This vulnerability is due to insufficient validation of incoming Internet Key Exchange Version 2 (IKEv2) packets. An attacker could exploit this vulnerability by sending specifically malformed IKEv2 packets to an affected device. A successful exploit could allow the attacker to cause the ipsecmgr process to restart, which would disrupt ongoing IKE negotiations and result in a temporary DoS condition.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Affected
223 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | asr_5000_series | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
| cisco | cisco_asr_5000_series_software | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_cisco5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7q9w-6xw2-qfxq: A vulnerability in the ipsecmgr process of Cisco ASR 5000 Series Software (StarOS) could allow an unauthenticated, remote attacker to cause a denial o
ghsa_unreviewed·2024-11-18
CVE-2021-1424 [MEDIUM] CWE-119 GHSA-7q9w-6xw2-qfxq: A vulnerability in the ipsecmgr process of Cisco ASR 5000 Series Software (StarOS) could allow an unauthenticated, remote attacker to cause a denial o
A vulnerability in the ipsecmgr process of Cisco ASR 5000 Series Software (StarOS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
This vulnerability is due to insufficient validation of incoming Internet Key Exchange Version 2 (IKEv2) packets. An attacker could exploit this vulnerability by sending specifically malformed IKEv2 packets to an affected device. A successful exploit could allow the attacker to cause the ipsecmgr process to restart, which would disrupt ongoing IKE negotiations and result in a temporary DoS condition.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Cisco
Cisco ASR 5000 Series Software (StarOS) ipsecmgr Process Denial of Service Vulnerability
vendor_cisco·2021-03-03·CVSS 5.3
CVE-2021-1424 [MEDIUM] CWE-119 Cisco ASR 5000 Series Software (StarOS) ipsecmgr Process Denial of Service Vulnerability
Cisco ASR 5000 Series Software (StarOS) ipsecmgr Process Denial of Service Vulnerability
A vulnerability in the ipsecmgr process of Cisco ASR 5000 Series Software (StarOS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
This vulnerability is due to insufficient validation of incoming Internet Key Exchange Version 2 (IKEv2) packets. An attacker could exploit this vulnerability by sending specifically malformed IKEv2 packets to an affected device. A successful exploit could allow the attacker to cause the ipsecmgr process to restart, which would disrupt ongoing IKE negotiations and result in a temporary DoS condition.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
T
Cisco
Cisco ASR 5000 Series Software (StarOS) ipsecmgr Process Denial of Service Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-1424 Cisco ASR 5000 Series Software (StarOS) ipsecmgr Process Denial of Service Vulnerability
CVE-2021-1424: Cisco ASR 5000 Series Software (StarOS) ipsecmgr Process Denial of Service Vulnerability
A vulnerability in the ipsecmgr process of Cisco ASR 5000 Series Software (StarOS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to insufficient validation of incoming Internet Key Exchange Version 2 (IKEv2) packets. An attacker could exploit this vulnerability by sending specifically malformed IKEv2 packets to an affected device. A successful exploit could allow the attacker to cause the ipsecmgr process to restart, which would disrupt ongoing IKE negotiations and result in a temporary DoS condition. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-119, CWE-119
B
Suricata
ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetLocalLink Authenticated Command Injection Attempt (CVE-2021-40410, CVE-2021-40411)
suricata·2025-01-27·CVSS 7.2
CVE-2021-40410 [HIGH] ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetLocalLink Authenticated Command Injection Attempt (CVE-2021-40410, CVE-2021-40411)
ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetLocalLink Authenticated Command Injection Attempt (CVE-2021-40410, CVE-2021-40411)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetLocalLink Authenticated Command Injection Attempt (CVE-2021-40410, CVE-2021-40411)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/api.cgi|3f|cmd|3d|SetLocalLink"; fast_pattern; startswith; http.request_body; content:"|22|cmd|22|"; content:"|22|SetLocalLink|22 2c|"; within:20; content:"|22|dns"; distance:0; pcre:"/^[12]\x22\x3a[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,talosintelligence.com/vulnerability_reports/TALOS-2021-1424; reference:cve,2021-40410; r
Suricata
ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetDdns Authenticated Command Injection Attempt (CVE-2021-40407, CVE-2021-40408, CVE-2021-40409)
suricata·2025-01-27·CVSS 7.2
CVE-2021-40407 [HIGH] ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetDdns Authenticated Command Injection Attempt (CVE-2021-40407, CVE-2021-40408, CVE-2021-40409)
ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetDdns Authenticated Command Injection Attempt (CVE-2021-40407, CVE-2021-40408, CVE-2021-40409)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetDdns Authenticated Command Injection Attempt (CVE-2021-40407, CVE-2021-40408, CVE-2021-40409)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/api.cgi|3f|cmd|3d|SetDdns"; fast_pattern; startswith; http.request_body; content:"|22|cmd|22|"; content:"|22|SetDdns|22 2c|"; within:20; pcre:"/^.+\x22(?:domain|password|username)\x22\x3a[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/Rm"; reference:url,talosintelligence.com/vulnerability_reports/TALOS-2021-1424; reference:cve,2
Suricata
ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetDevName Authenticated Command Injection Attempt (CVE-2021-40412)
suricata·2025-01-27·CVSS 7.2
CVE-2021-40412 [HIGH] ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetDevName Authenticated Command Injection Attempt (CVE-2021-40412)
ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetDevName Authenticated Command Injection Attempt (CVE-2021-40412)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Reolink RLC Series IP Camera SetDevName Authenticated Command Injection Attempt (CVE-2021-40412)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/api.cgi|3f|cmd|3d|SetDevName"; fast_pattern; startswith; http.request_body; content:"|22|cmd|22|"; content:"|22|SetDevName|22 2c|"; within:20; content:"|22|name|22 3a|"; distance:0; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,talosintelligence.com/vulnerability_reports/TALOS-2021-1424; reference:cve,2021-40412; classtype:attempted-admin; sid:2059717; rev:1
No public exploits indexed.
No writeups or analysis indexed.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-webui-gQLSFyPMhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-info-disclo-VOu2GHbZhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-sigverbypass-gPYXd6Mkhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-ipsecmgr-dos-3gkHXwvShttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrbgp-rpki-dos-gvmjqxbk
2024-11-18
Published