CVE-2021-1453 — Improper Verification of Cryptographic Signature in Cisco IOS XE Software

CWE-347 — Improper Verification of Cryptographic Signature4 documents4 sources
Severity
6.8MEDIUMNVD
EPSS
0.1%
top 83.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOS XE SoftwareCisco IOS XE
Timeline
PublishedMar 24
Latest updateMay 24

Description

A vulnerability in the software image verification functionality of Cisco IOS XE Software for the Cisco Catalyst 9000 Family of switches could allow an unauthenticated, physical attacker to execute unsigned code at system boot time. The vulnerability is due to an improper check in the code function that manages the verification of the digital signatures of system image files during the initial boot process. An attacker could exploit this vulnerability by loading unsigned software on an affected …

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 0.9 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/ios_xe55 versions+54

🔴Vulnerability Details

2
GHSA
GHSA-j5cc-94pp-784r: A vulnerability in the software image verification functionality of Cisco IOS XE Software for the Cisco Catalyst 9000 Family of switches could allow a↗2022-05-24
▶
CVEList
Cisco IOS XE Software for the Catalyst 9000 Family Arbitrary Code Execution Vulnerability↗2021-03-24
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XE Software for the Catalyst 9000 Family Arbitrary Code Execution Vulnerability↗2021-03-24
▶
CVE-2021-1453 — Cisco IOS XE Software vulnerability | cvebase