CVE-2021-34793
Estado: ModificadaAlta (8.6)—
A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent mode could allow an unauthenticated, remote attacker to poison MAC address tables, resulting in a denial of service (DoS) vulnerability. This vulnerability is due to incorrect handling of certain TCP segments when the affected device is operating in transparent mode. An attacker could exploit this vulnerability by sending a crafted TCP segment through an affected device. A successful exploit could allow the attacker to poison the MAC address tables in adjacent devices, resulting in network disruption.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Puntuación base: 8.6
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.58%
- Percentil entre todas las CVEs puntuadas: 46
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (11)
Cisco — Adaptive Security ApplianceCisco — Adaptive Security Appliance SoftwareCisco — ASA 5505 FirmwareCisco — ASA 5512-x FirmwareCisco — ASA 5515-x FirmwareCisco — ASA 5525-x FirmwareCisco — ASA 5545-x FirmwareCisco — ASA 5555-x FirmwareCisco — ASA 5580 FirmwareCisco — ASA 5585-x FirmwareCisco — Secure Firewall Threat Defense
CWE
- CWE-924
- CWE-924
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-34793",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2021-34793",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-11-07T21:44:27.592582Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 8.6,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 4,
"exploitabilityScore": 3.9
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 8.6,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 4,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Adaptive Security Appliance (ASA) Software",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2021-10-27T19:15:08.563",
"references": [
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-dos-JxYWMJyL",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
},
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-dos-JxYWMJyL",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-924"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-924"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent mode could allow an unauthenticated, remote attacker to poison MAC address tables, resulting in a denial of service (DoS) vulnerability. This vulnerability is due to incorrect handling of certain TCP segments when the affected device is operating in transparent mode. An attacker could exploit this vulnerability by sending a crafted TCP segment through an affected device. A successful exploit could allow the attacker to poison the MAC address tables in adjacent devices, resulting in network disruption."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el Normalizador TCP del software Cisco Adaptive Security Appliance (ASA) y del software Firepower Threat Defense (FTD) que funciona en modo transparente podría permitir a un atacante remoto no autenticado envenenar las tablas de direcciones MAC, lo que provocaría una vulnerabilidad de denegación de servicio (DoS). Esta vulnerabilidad es debido al manejo incorrecto de determinados segmentos TCP cuando el dispositivo afectado está operando en modo transparente. Un atacante podría explotar esta vulnerabilidad mediante el envío de un segmento TCP diseñado mediante un dispositivo afectado. Una explotación con éxito podría permitir al atacante envenenar las tablas de direcciones MAC en los dispositivos adyacentes, resultando en una interrupción de la red"
}
],
"lastModified": "2026-08-11T19:37:30.880",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C7F329B-4EF5-411A-9AB6-02E6A4162D6D",
"versionEndExcluding": "9.8.4.40"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D5F57AA9-B4B0-4BF7-A32D-B5628929BC23",
"versionEndExcluding": "6.4.0.13"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6BAB496F-F3FF-4188-B191-64ED999CDF1C",
"versionEndExcluding": "6.6.5",
"versionStartIncluding": "6.5.0"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AEC6CF5C-9A31-41B0-99EA-FB2734E4CFDD",
"versionEndExcluding": "6.7.0.3",
"versionStartIncluding": "6.7.0"
},
{
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "796D02D8-AD57-49E8-93F6-5CC0E4D2F883",
"versionEndExcluding": "9.12.4.29",
"versionStartIncluding": "9.9.0"
},
{
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "333EFE8A-1514-4F7A-BBF4-876DC1B2E5A4",
"versionEndExcluding": "9.14.3.9",
"versionStartIncluding": "9.13.0"
},
{
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F6EC0723-CBC7-45A7-8B30-B680E8A771EF",
"versionEndExcluding": "9.15.1.17",
"versionStartIncluding": "9.15.0"
},
{
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "310B86D1-730D-4D8A-AC95-31FBE4F7D1E6",
"versionEndExcluding": "9.16.2.3",
"versionStartIncluding": "9.16.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5512-x_firmware:009.008\\(004.025\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A8A0AC98-6994-4055-99FC-C24E7DD2964D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "08F0F160-DAD2-48D4-B7B2-4818B2526F35"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5505_firmware:009.008\\(004.025\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "325AF17C-5C97-44CC-9F72-E077E2E5968C"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8E6A8BB7-2000-4CA2-9DD7-89573CE4C73A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5515-x_firmware:009.008\\(004.025\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC3C43A2-BFA1-4A53-8D7B-0270050D3CE9"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "977D597B-F6DE-4438-AB02-06BE64D71EBE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5525-x_firmware:009.008\\(004.025\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6CC7F335-8D93-408F-A9B6-427AEC590BE7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EB71EB29-0115-4307-A9F7-262394FD9FB0"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5545-x_firmware:009.008\\(004.025\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "50319E62-91FD-40EC-98C0-F2ADB51EA8B8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "57179F60-E330-4FF0-9664-B1E4637FF210"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5555-x_firmware:009.008\\(004.025\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73A3286F-B9A7-407C-A08A-C4BBF6EAF03D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5535C936-391B-4619-AA03-B35265FC15D7"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5580_firmware:009.008\\(004.025\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4205DEA9-C321-4845-B86A-07EABA461DD9"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D1E828B8-5ECC-4A09-B2AD-DEDC558713DE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5585-x_firmware:009.008\\(004.025\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D8296D0-BEE7-4788-AE23-E880345CD06A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "16AE20C2-C77E-4E04-BF13-A48696E52426"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@cisco.com"
}