CVE-2021-1312: Cisco Elastic Services Controller Denial of Service Vulnerability
A vulnerability in the system resource management of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) to the health monitor API on an affected device. The vulnerability is due to inadequate provisioning of kernel parameters for the maximum number of TCP connections and SYN backlog. An attacker could exploit this vulnerability by sending a flood of crafted TCP packets to an affected device. A successful exploit could allow the attacker to block TCP listening ports that are used by the health monitor API. This vulnerability only affects customers who use the health monitor API.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-1312?
CVE-2021-1312 has a severity rating of medium, indicating a moderate impact on system availability.
How do I fix CVE-2021-1312?
To mitigate CVE-2021-1312, upgrade Cisco Elastic Services Controller to version 5.3.0.95 or later.
What are the potential impacts of CVE-2021-1312?
CVE-2021-1312 could lead to a denial of service (DoS) affecting the health monitor API on vulnerable Cisco devices.
Is authentication required to exploit CVE-2021-1312?
No, CVE-2021-1312 can be exploited by an unauthenticated remote attacker.
Which Cisco products are affected by CVE-2021-1312?
CVE-2021-1312 specifically affects Cisco Elastic Services Controller versions up to 5.3.0.94.