CVE-2021-1356: Cisco IOS XE Software Web UI Denial of Service Vulnerabilities
First published: Wed Mar 24 2021(Updated: )
Multiple vulnerabilities in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to cause the web UI software to become unresponsive and consume vty line instances, resulting in a denial of service (DoS) condition. These vulnerabilities are due to insufficient error handling in the web UI. An attacker could exploit these vulnerabilities by sending crafted HTTP packets to an affected device. A successful exploit could allow the attacker to cause the web UI software to become unresponsive and consume all available vty lines, preventing new session establishment and resulting in a DoS condition. Manual intervention would be required to regain web UI and vty session functionality. Note: These vulnerabilities do not affect the console connection.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE Web UI | =3.15.1xbs | |
| Cisco IOS XE Web UI | =3.15.2xbs | |
| Cisco IOS XE Web UI | =17.1.1 | |
| Cisco IOS XE Web UI | =17.1.1a | |
| Cisco IOS XE Web UI | =17.1.1s | |
| Cisco IOS XE Web UI | =17.1.1t | |
| Cisco IOS XE Web UI | =17.1.2 | |
| Cisco IOS XE Web UI | =17.2.1 | |
| Cisco IOS XE Web UI | =17.2.1a | |
| Cisco IOS XE Web UI | =17.2.1r | |
| Cisco IOS XE Web UI | =17.2.1v | |
| Cisco IOS XE Web UI | =17.2.2 | |
| Cisco IOS XE Web UI | =17.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-1356?
CVE-2021-1356 has been rated as high severity due to its potential to cause denial of service conditions.
How do I fix CVE-2021-1356?
To fix CVE-2021-1356, you should update to the latest version of Cisco IOS XE Software that addresses this vulnerability.
Who is affected by CVE-2021-1356?
CVE-2021-1356 affects specific versions of Cisco IOS XE Software, primarily those listed in the advisory.
What type of attack does CVE-2021-1356 involve?
CVE-2021-1356 involves authenticated remote attackers exploiting vulnerabilities in the web UI to create denial of service conditions.
What are the impacts of CVE-2021-1356?
The impact of CVE-2021-1356 can result in the web UI becoming unresponsive and consuming vty line instances.
- agent/type
- agent/softwarecombine
- agent/author
- agent/references
- agent/title
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xe web ui
- version/cisco ios xe web ui/3.15.1xbs
- version/cisco ios xe web ui/3.15.2xbs
- version/cisco ios xe web ui/17.1.1
- version/cisco ios xe web ui/17.1.1a
- version/cisco ios xe web ui/17.1.1s
- version/cisco ios xe web ui/17.1.1t
- version/cisco ios xe web ui/17.1.2
- version/cisco ios xe web ui/17.2.1
- version/cisco ios xe web ui/17.2.1a
- version/cisco ios xe web ui/17.2.1r
- version/cisco ios xe web ui/17.2.1v
- version/cisco ios xe web ui/17.2.2
- version/cisco ios xe web ui/17.2.3