cbcvebase.
CVE-2021-1451
published 2021-03-24

CVE-2021-1451: A vulnerability in the Easy Virtual Switching System (VSS) feature of Cisco IOS XE Software for Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X…

PriorityP269critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.21%
86.6th percentile
A vulnerability in the Easy Virtual Switching System (VSS) feature of Cisco IOS XE Software for Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying Linux operating system of an affected device. The vulnerability is due to incorrect boundary checks of certain values in Easy VSS protocol packets that are destined for an affected device. An attacker could exploit this vulnerability by sending crafted Easy VSS protocol packets to UDP port 5500 while the affected device is in a specific state. When the crafted packet is processed, a buffer overflow condition may occur. A successful exploit could allow the attacker to trigger a denial of service (DoS) condition or execute arbitrary code with root privileges on the underlying Linux operating system of the affected device.

Affected

56 ranges· showing 25
VendorProductVersion rangeFixed in
ciscocisco_ios_xe_software——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——
ciscoios_xe——

Detection & IOCsextracted from sources · hover to see the quote

portUDP/5500↗
  • →Detect crafted Easy VSS protocol packets sent to UDP port 5500 targeting Cisco Catalyst 4500/4500-X Series Switches running IOS XE; anomalous or malformed packets to this port from untrusted/external sources should be flagged. ↗
  • →Monitor for buffer overflow indicators or unexpected root-level process execution on the underlying Linux OS of affected Cisco Catalyst 4500/4500-X devices, which may indicate successful exploitation. ↗
  • →Track Cisco Bug ID CSCvv66062 for patch status and affected version enumeration to prioritize vulnerable asset identification. ↗
  • ·Exploitation requires the affected device to be in a specific state (Easy VSS feature active/configured); devices not using Easy VSS are not exploitable via this vector. ↗
  • ·There are no workarounds available for this vulnerability; only software updates remediate it. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_cisco8.1HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.