CVE-2021-1624 — Uncontrolled Resource Consumption in Cisco IOS XE

CWE-399CWE-400 — Uncontrolled Resource ConsumptionCWE-476 — NULL Pointer Dereference5 documents5 sources
Severity
8.6HIGHNVD
EPSS
0.4%
top 38.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOS XECisco IOS XE Software
Timeline
PublishedSep 23
Latest updateMay 24

Description

A vulnerability in the Rate Limiting Network Address Translation (NAT) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause high CPU utilization in the Cisco QuantumFlow Processor of an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to mishandling of the rate limiting feature within the QuantumFlow Processor. An attacker could exploit this vulnerability by sending large amounts of traffic that would be subject to …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 3.9 | Impact: 4.0

Affected Packages2 packages

▶NVDcisco/ios_xe17.3.3

🔴Vulnerability Details

2
GHSA
GHSA-xj7m-j8gx-jwq9: A vulnerability in the Rate Limiting Network Address Translation (NAT) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacke↗2022-05-24
▶
CVEList
Cisco IOS XE Software Rate Limiting Network Address Translation Denial of Service Vulnerability↗2021-09-23
▶

📋Vendor Advisories

2
Red Hat
kernel: net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()↗2024-05-24
▶
Cisco
Cisco IOS XE Software Rate Limiting Network Address Translation Denial of Service Vulnerability↗2021-09-22
▶
CVE-2021-1624 — Uncontrolled Resource Consumption | cvebase