6.9

CVE-2021-34721

Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Asr 9000v-v2 Version-
   Cisco ≫ Asr 9001 Version-
   Cisco ≫ Asr 9006 Version-
   Cisco ≫ Asr 9010 Version-
   Cisco ≫ Asr 9901 Version-
   Cisco ≫ Asr 9902 Version-
   Cisco ≫ Asr 9903 Version-
   Cisco ≫ Asr 9904 Version-
   Cisco ≫ Asr 9906 Version-
   Cisco ≫ Asr 9910 Version-
   Cisco ≫ Asr 9912 Version-
   Cisco ≫ Asr 9922 Version-
Cisco ≫ Ios Xr Version >= 7.4.0 <= 7.4.1
   Cisco ≫ Asr 9000v-v2 Version-
   Cisco ≫ Asr 9001 Version-
   Cisco ≫ Asr 9006 Version-
   Cisco ≫ Asr 9010 Version-
   Cisco ≫ Asr 9901 Version-
   Cisco ≫ Asr 9902 Version-
   Cisco ≫ Asr 9903 Version-
   Cisco ≫ Asr 9904 Version-
   Cisco ≫ Asr 9906 Version-
   Cisco ≫ Asr 9910 Version-
   Cisco ≫ Asr 9912 Version-
   Cisco ≫ Asr 9922 Version-
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ios Xrv Version-
   Cisco ≫ Ios Xrv 9000 Version-
Cisco ≫ Ios Xr Version >= 7.4.0 <= 7.4.1
   Cisco ≫ Ios Xrv Version-
   Cisco ≫ Ios Xrv 9000 Version-
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 520 Version-
   Cisco ≫ Ncs 540 Version-
   Cisco ≫ Ncs 540 Fronthaul Version-
   Cisco ≫ Ncs 560-4 Version-
   Cisco ≫ Ncs 560-7 Version-
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 520 Version-
   Cisco ≫ Ncs 540 Version-
   Cisco ≫ Ncs 540 Fronthaul Version-
   Cisco ≫ Ncs 560-4 Version-
   Cisco ≫ Ncs 560-7 Version-
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 5001 Version-
   Cisco ≫ Ncs 5002 Version-
   Cisco ≫ Ncs 5011 Version-
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 5001 Version-
   Cisco ≫ Ncs 5002 Version-
   Cisco ≫ Ncs 5011 Version-
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 5501 Version-
   Cisco ≫ Ncs 5501-se Version-
   Cisco ≫ Ncs 5502 Version-
   Cisco ≫ Ncs 5502-se Version-
   Cisco ≫ Ncs 5508 Version-
   Cisco ≫ Ncs 5516 Version-
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 5501 Version-
   Cisco ≫ Ncs 5501-se Version-
   Cisco ≫ Ncs 5502 Version-
   Cisco ≫ Ncs 5502-se Version-
   Cisco ≫ Ncs 5508 Version-
   Cisco ≫ Ncs 5516 Version-
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 6000 Version-
   Cisco ≫ Ncs 6008 Version-
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 6000 Version-
   Cisco ≫ Ncs 6008 Version-
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ Ncs 1001 Version-
   Cisco ≫ Ncs 1002 Version-
   Cisco ≫ Ncs 1004 Version-
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ Ncs 1001 Version-
   Cisco ≫ Ncs 1002 Version-
   Cisco ≫ Ncs 1004 Version-
Cisco ≫ Ios Xr Version < 7.3.2
   Cisco ≫ 8101-32fh Version-
   Cisco ≫ 8101-32h Version-
   Cisco ≫ 8102-64h Version-
   Cisco ≫ 8201 Version-
   Cisco ≫ 8201-32fh Version-
   Cisco ≫ 8202 Version-
   Cisco ≫ 8804 Version-
   Cisco ≫ 8808 Version-
   Cisco ≫ 8812 Version-
   Cisco ≫ 8818 Version-
Cisco ≫ Ios Xr Version >= 7.4.0 < 7.4.1
   Cisco ≫ 8101-32fh Version-
   Cisco ≫ 8101-32h Version-
   Cisco ≫ 8102-64h Version-
   Cisco ≫ 8201 Version-
   Cisco ≫ 8201-32fh Version-
   Cisco ≫ 8202 Version-
   Cisco ≫ 8804 Version-
   Cisco ≫ 8808 Version-
   Cisco ≫ 8812 Version-
   Cisco ≫ 8818 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.07% 0.22
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
psirt@cisco.com 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.