8.6

CVE-2021-1622

A vulnerability in the Common Open Policy Service (COPS) of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker to cause resource exhaustion, resulting in a denial of service (DoS) condition. This vulnerability is due to a deadlock condition in the code when processing COPS packets under certain conditions. An attacker could exploit this vulnerability by sending COPS packets with high burst rates to an affected device. A successful exploit could allow the attacker to cause the CPU to consume excessive resources, which prevents other control plane processes from obtaining resources and results in a DoS.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Ios Xe Version < 16.12.1z1
   Cisco ≫ 7600 Router Version-
   Cisco ≫ Asr 901-12c-f-d Version-
   Cisco ≫ Asr 901-12c-ft-d Version-
   Cisco ≫ Asr 901-4c-f-d Version-
   Cisco ≫ Asr 901-4c-ft-d Version-
   Cisco ≫ Asr 901-6cz-f-a Version-
   Cisco ≫ Asr 901-6cz-f-d Version-
   Cisco ≫ Asr 901-6cz-fs-a Version-
   Cisco ≫ Asr 901-6cz-fs-d Version-
   Cisco ≫ Asr 901-6cz-ft-a Version-
   Cisco ≫ Asr 901-6cz-ft-d Version-
   Cisco ≫ Cbr-8 Version-
Cisco ≫ Ios Xe Version17.3.1x
   Cisco ≫ 7600 Router Version-
   Cisco ≫ Asr 901-12c-f-d Version-
   Cisco ≫ Asr 901-12c-ft-d Version-
   Cisco ≫ Asr 901-4c-f-d Version-
   Cisco ≫ Asr 901-4c-ft-d Version-
   Cisco ≫ Asr 901-6cz-f-a Version-
   Cisco ≫ Asr 901-6cz-f-d Version-
   Cisco ≫ Asr 901-6cz-fs-a Version-
   Cisco ≫ Asr 901-6cz-fs-d Version-
   Cisco ≫ Asr 901-6cz-ft-a Version-
   Cisco ≫ Asr 901-6cz-ft-d Version-
   Cisco ≫ Cbr-8 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.27% 0.501
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.6 3.9 4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
psirt@cisco.com 8.6 3.9 4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CWE-667 Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

CWE-833 Deadlock

The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.