« Volver al listado

CVE-2021-1622

Estado: ModificadaAlta (8.6)—

A vulnerability in the Common Open Policy Service (COPS) of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker to cause resource exhaustion, resulting in a denial of service (DoS) condition. This vulnerability is due to a deadlock condition in the code when processing COPS packets under certain conditions. An attacker could exploit this vulnerability by sending COPS packets with high burst rates to an affected device. A successful exploit could allow the attacker to cause the CPU to consume excessive resources, which prevents other control plane processes from obtaining resources and results in a DoS.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — IOS XE

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-1622",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-1622",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-07T21:54:19.874106Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@cisco.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "Cisco",
          "product": "Cisco IOS XE Software",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-09-23T03:15:13.353",
  "references": [
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cbr8-cops-Vc2ZsJSx",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cbr8-cops-Vc2ZsJSx",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-833"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-667"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Common Open Policy Service (COPS) of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker to cause resource exhaustion, resulting in a denial of service (DoS) condition. This vulnerability is due to a deadlock condition in the code when processing COPS packets under certain conditions. An attacker could exploit this vulnerability by sending COPS packets with high burst rates to an affected device. A successful exploit could allow the attacker to cause the CPU to consume excessive resources, which prevents other control plane processes from obtaining resources and results in a DoS."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el Servicio de Política Abierta Común (COPS) de Cisco IOS XE Software para Cisco cBR-8 Converged Broadband Routers podría permitir a un atacante remoto no autenticado causar el agotamiento de los recursos, resultando en una condición de denegación de servicio (DoS). Esta vulnerabilidad es debido a una condición de bloqueo en el código cuando se procesan paquetes COPS bajo determinadas condiciones. Un atacante podría explotar esta vulnerabilidad mediante el envío de paquetes COPS con altas tasas de ráfagas a un dispositivo afectado. Una explotación con éxito podría permitir al atacante causar el consumo excesivo de recursos de la CPU, que impide que otros procesos del plano de control obtengan recursos y resulta en una DoS"
    }
  ],
  "lastModified": "2026-06-17T03:32:11.393",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F28F7CDF-B79D-4856-868E-F375BEA297F5",
              "versionEndExcluding": "16.12.1z1"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xe:17.3.1x:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4046C325-7EDB-4C95-AA98-541BEC8F9E0F"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:7600_router:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F65D6BF2-7016-4C1C-93BC-F5742F299607"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_901-12c-f-d:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D6279A69-2F9D-4CD9-9C19-62E701C3C4F9"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_901-12c-ft-d:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A46BB1E3-D813-4C19-81FA-96B8EF3E2F7B"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_901-4c-f-d:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "64E9CCC6-CA54-44C4-9A41-D2CA3A25BE8C"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_901-4c-ft-d:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "BC4E0CC8-9C67-4EB0-97A1-BAEFC6E9708A"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_901-6cz-f-a:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DDB1A95C-8513-4CC7-8CDF-012B212FF02F"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_901-6cz-f-d:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "AE761B1C-D749-4E1B-9A4A-7F41D1DF9C8C"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_901-6cz-fs-a:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "97B64B28-7F3F-40BC-B289-0D1DB55B6461"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_901-6cz-fs-d:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F5603296-34B3-4EEB-B242-C44BC56BFBB8"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_901-6cz-ft-a:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6C2A515C-797D-47EE-8051-F3FBE417BCE9"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_901-6cz-ft-d:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E673A75F-EFF8-4591-8E0F-A21083563DBA"
            },
            {
              "criteria": "cpe:2.3:h:cisco:cbr-8:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "AB77D0EC-A448-4D97-8EB0-EA4956549A52"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}