7.8

CVE-2021-34719

Cisco IOS XR Software Authenticated User Privilege Escalation Vulnerabilities

Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker with a low-privileged account to elevate privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Asr 9000v-v2 Version -
   Cisco ≫ Asr 9001 Version -
   Cisco ≫ Asr 9006 Version -
   Cisco ≫ Asr 9010 Version -
   Cisco ≫ Asr 9901 Version -
   Cisco ≫ Asr 9902 Version -
   Cisco ≫ Asr 9903 Version -
   Cisco ≫ Asr 9904 Version -
   Cisco ≫ Asr 9906 Version -
   Cisco ≫ Asr 9910 Version -
   Cisco ≫ Asr 9912 Version -
   Cisco ≫ Asr 9922 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 <= 7.4.1
   Cisco ≫ Asr 9000v-v2 Version -
   Cisco ≫ Asr 9001 Version -
   Cisco ≫ Asr 9006 Version -
   Cisco ≫ Asr 9010 Version -
   Cisco ≫ Asr 9901 Version -
   Cisco ≫ Asr 9902 Version -
   Cisco ≫ Asr 9903 Version -
   Cisco ≫ Asr 9904 Version -
   Cisco ≫ Asr 9906 Version -
   Cisco ≫ Asr 9910 Version -
   Cisco ≫ Asr 9912 Version -
   Cisco ≫ Asr 9922 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ios Xrv Version -
   Cisco ≫ Ios Xrv 9000 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 <= 7.4.1
   Cisco ≫ Ios Xrv Version -
   Cisco ≫ Ios Xrv 9000 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 520 Version -
   Cisco ≫ Ncs 540 Version -
   Cisco ≫ Ncs 540 Fronthaul Version -
   Cisco ≫ Ncs 560-4 Version -
   Cisco ≫ Ncs 560-7 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 520 Version -
   Cisco ≫ Ncs 540 Version -
   Cisco ≫ Ncs 540 Fronthaul Version -
   Cisco ≫ Ncs 560-4 Version -
   Cisco ≫ Ncs 560-7 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 5001 Version -
   Cisco ≫ Ncs 5002 Version -
   Cisco ≫ Ncs 5011 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 5001 Version -
   Cisco ≫ Ncs 5002 Version -
   Cisco ≫ Ncs 5011 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 4009 Version -
   Cisco ≫ Ncs 4016 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 4009 Version -
   Cisco ≫ Ncs 4016 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 5501 Version -
   Cisco ≫ Ncs 5501-se Version -
   Cisco ≫ Ncs 5502 Version -
   Cisco ≫ Ncs 5502-se Version -
   Cisco ≫ Ncs 5508 Version -
   Cisco ≫ Ncs 5516 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 5501 Version -
   Cisco ≫ Ncs 5501-se Version -
   Cisco ≫ Ncs 5502 Version -
   Cisco ≫ Ncs 5502-se Version -
   Cisco ≫ Ncs 5508 Version -
   Cisco ≫ Ncs 5516 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 6000 Version -
   Cisco ≫ Ncs 6008 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 6000 Version -
   Cisco ≫ Ncs 6008 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 1001 Version -
   Cisco ≫ Ncs 1002 Version -
   Cisco ≫ Ncs 1004 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 1001 Version -
   Cisco ≫ Ncs 1002 Version -
   Cisco ≫ Ncs 1004 Version -
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ 8101-32fh Version -
   Cisco ≫ 8101-32h Version -
   Cisco ≫ 8102-64h Version -
   Cisco ≫ 8201 Version -
   Cisco ≫ 8201-32fh Version -
   Cisco ≫ 8202 Version -
   Cisco ≫ 8804 Version -
   Cisco ≫ 8808 Version -
   Cisco ≫ 8812 Version -
   Cisco ≫ 8818 Version -
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ 8101-32fh Version -
   Cisco ≫ 8101-32h Version -
   Cisco ≫ 8102-64h Version -
   Cisco ≫ 8201 Version -
   Cisco ≫ 8201-32fh Version -
   Cisco ≫ 8202 Version -
   Cisco ≫ 8804 Version -
   Cisco ≫ 8808 Version -
   Cisco ≫ 8812 Version -
   Cisco ≫ 8818 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.28% 0.2
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
Cisco PSIRT 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privescal-dZYMrKf
Vendor Advisory