8.5

CVE-2021-34718

Cisco IOS XR Software Arbitrary File Read and Write Vulnerability

A vulnerability in the SSH Server process of Cisco IOS XR Software could allow an authenticated, remote attacker to overwrite and read arbitrary files on the local device. This vulnerability is due to insufficient input validation of arguments that are supplied by the user for a specific file transfer method. An attacker with lower-level privileges could exploit this vulnerability by specifying Secure Copy Protocol (SCP) parameters when authenticating to a device. A successful exploit could allow the attacker to elevate their privileges and retrieve and upload files on a device that they should not have access to.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Asr 9000v-v2 Version -
   Cisco ≫ Asr 9001 Version -
   Cisco ≫ Asr 9006 Version -
   Cisco ≫ Asr 9010 Version -
   Cisco ≫ Asr 9901 Version -
   Cisco ≫ Asr 9902 Version -
   Cisco ≫ Asr 9903 Version -
   Cisco ≫ Asr 9904 Version -
   Cisco ≫ Asr 9906 Version -
   Cisco ≫ Asr 9910 Version -
   Cisco ≫ Asr 9912 Version -
   Cisco ≫ Asr 9922 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Asr 9000v-v2 Version -
   Cisco ≫ Asr 9001 Version -
   Cisco ≫ Asr 9006 Version -
   Cisco ≫ Asr 9010 Version -
   Cisco ≫ Asr 9901 Version -
   Cisco ≫ Asr 9902 Version -
   Cisco ≫ Asr 9903 Version -
   Cisco ≫ Asr 9904 Version -
   Cisco ≫ Asr 9906 Version -
   Cisco ≫ Asr 9910 Version -
   Cisco ≫ Asr 9912 Version -
   Cisco ≫ Asr 9922 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ios Xrv Version -
   Cisco ≫ Ios Xrv 9000 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ios Xrv Version -
   Cisco ≫ Ios Xrv 9000 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 520 Version -
   Cisco ≫ Ncs 540 Version -
   Cisco ≫ Ncs 540 Fronthaul Version -
   Cisco ≫ Ncs 560-4 Version -
   Cisco ≫ Ncs 560-7 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 520 Version -
   Cisco ≫ Ncs 540 Version -
   Cisco ≫ Ncs 540 Fronthaul Version -
   Cisco ≫ Ncs 560-4 Version -
   Cisco ≫ Ncs 560-7 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 5001 Version -
   Cisco ≫ Ncs 5002 Version -
   Cisco ≫ Ncs 5011 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 5001 Version -
   Cisco ≫ Ncs 5002 Version -
   Cisco ≫ Ncs 5011 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 4009 Version -
   Cisco ≫ Ncs 4016 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 4009 Version -
   Cisco ≫ Ncs 4016 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 5501 Version -
   Cisco ≫ Ncs 5501-se Version -
   Cisco ≫ Ncs 5502 Version -
   Cisco ≫ Ncs 5502-se Version -
   Cisco ≫ Ncs 5508 Version -
   Cisco ≫ Ncs 5516 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 5501 Version -
   Cisco ≫ Ncs 5501-se Version -
   Cisco ≫ Ncs 5502 Version -
   Cisco ≫ Ncs 5502-se Version -
   Cisco ≫ Ncs 5508 Version -
   Cisco ≫ Ncs 5516 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 6000 Version -
   Cisco ≫ Ncs 6008 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 6000 Version -
   Cisco ≫ Ncs 6008 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 1001 Version -
   Cisco ≫ Ncs 1002 Version -
   Cisco ≫ Ncs 1004 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 1001 Version -
   Cisco ≫ Ncs 1002 Version -
   Cisco ≫ Ncs 1004 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.58% 0.725
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NIST 8.5 8 9.2
AV:N/AC:L/Au:S/C:C/I:C/A:N
Cisco PSIRT 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-scp-inject-QwZOCv2
Vendor Advisory