CVE-2021-1451 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Cisco IOS XE Software

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources

Severity

9.8CRITICALNVD

CNA8.1

EPSS

0.7%

top 28.95%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco IOS XE Software Cisco IOS XE

Timeline

PublishedMar 24

Latest updateMay 24

Description

A vulnerability in the Easy Virtual Switching System (VSS) feature of Cisco IOS XE Software for Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying Linux operating system of an affected device. The vulnerability is due to incorrect boundary checks of certain values in Easy VSS protocol packets that are destined for an affected device. An attacker could exploit this vulnerability …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5cisco/cisco_ios_xe_softwaren/a

▶NVDcisco/ios_xe54 versions+53

🔴Vulnerability Details

GHSA

GHSA-h8m7-5ghv-9r78: A vulnerability in the Easy Virtual Switching System (VSS) feature of Cisco IOS XE Software for Cisco Catalyst 4500 Series Switches and Cisco Catalyst↗2022-05-24

▶

CVEList

Cisco IOS XE Software Easy Virtual Switching System Arbitrary Code Execution Vulnerability↗2021-03-24

▶

📋Vendor Advisories

Cisco

Cisco IOS XE Software Easy Virtual Switching System Arbitrary Code Execution Vulnerability↗2021-03-24

▶