CVE-2021-34790
Estado: ModificadaMedia (5.3)—
Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host located behind the ALG. For more information about these vulnerabilities, see the Details section of this advisory. Note: These vulnerabilities have been publicly discussed as NAT Slipstreaming.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Puntuación base: 5.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.14%
- Percentil entre todas las CVEs puntuadas: 65
- Fecha de la puntuación: 3/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (11)
Cisco — Adaptive Security ApplianceCisco — Adaptive Security Appliance SoftwareCisco — ASA 5505 FirmwareCisco — ASA 5512-x FirmwareCisco — ASA 5515-x FirmwareCisco — ASA 5525-x FirmwareCisco — ASA 5545-x FirmwareCisco — ASA 5555-x FirmwareCisco — ASA 5580 FirmwareCisco — ASA 5585-x FirmwareCisco — Secure Firewall Threat Defense
CWE
- CWE-358
- CWE-20
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-34790",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2021-34790",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-11-07T21:39:46.470574Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 4.7,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 1.4,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 1.4,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Adaptive Security Appliance (ASA) Software",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2021-10-27T19:15:08.400",
"references": [
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-natalg-bypass-cpKGqkng",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
},
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-natalg-bypass-cpKGqkng",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-358"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host located behind the ALG. For more information about these vulnerabilities, see the Details section of this advisory. Note: These vulnerabilities have been publicly discussed as NAT Slipstreaming."
},
{
"lang": "es",
"value": "Varias vulnerabilidades en la Puerta de Enlace de Nivel de Aplicación (ALG) para la funcionalidad Network Address Translation (NAT) del software Cisco Adaptive Security Appliance (ASA) y el software Firepower Threat Defense (FTD) podrían permitir a un atacante remoto no autenticado omitir el ALG y abrir conexiones no autorizadas con un host situado detrás del ALG. Para conseguir más información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso. Nota: Estas vulnerabilidades han sido discutidas públicamente como NAT Slipstreaming"
}
],
"lastModified": "2026-08-11T19:37:30.880",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C7F329B-4EF5-411A-9AB6-02E6A4162D6D",
"versionEndExcluding": "9.8.4.40"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "578B7065-6A66-4E49-8D4A-A3A0B3224AB0",
"versionEndExcluding": "6.4.0.12"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6BAB496F-F3FF-4188-B191-64ED999CDF1C",
"versionEndExcluding": "6.6.5",
"versionStartIncluding": "6.5.0"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32F3BBEA-B436-4856-B598-E9DBD990DF4C",
"versionEndExcluding": "6.7.0.2",
"versionStartIncluding": "6.7.0"
},
{
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B10BB7F0-1CC7-4331-A05C-3C20B0584C04",
"versionEndExcluding": "9.12.4.29",
"versionStartIncluding": "9.12.0"
},
{
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "185792EB-E12D-4ABD-938F-68EB7F65FA3C",
"versionEndExcluding": "9.14.2.15",
"versionStartIncluding": "9.13.0"
},
{
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D6DA106A-A2D9-4F9F-AF9B-88F67A8589FC",
"versionEndExcluding": "9.15.1.15",
"versionStartIncluding": "9.15.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5512-x_firmware:009.008:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C8EAF9E-15BB-4565-A131-B0B3F9E98B50"
},
{
"criteria": "cpe:2.3:o:cisco:asa_5512-x_firmware:009.015:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D81100E4-D5B3-4953-9EB3-A4335A96B0FC"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "08F0F160-DAD2-48D4-B7B2-4818B2526F35"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5505_firmware:009.008:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "446D3F11-4E33-417E-8BC5-A0ADA2336748"
},
{
"criteria": "cpe:2.3:o:cisco:asa_5505_firmware:009.015:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF62190B-96EE-4295-BF8B-5A8F65876979"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8E6A8BB7-2000-4CA2-9DD7-89573CE4C73A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5515-x_firmware:009.008:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "649BB8A1-7665-4312-9D34-8823CD8031B0"
},
{
"criteria": "cpe:2.3:o:cisco:asa_5515-x_firmware:009.015:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2008D416-C0D8-41DB-9088-553665643A4D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "977D597B-F6DE-4438-AB02-06BE64D71EBE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5525-x_firmware:009.008:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D4DC944-D1C0-400F-92A2-852BED71210C"
},
{
"criteria": "cpe:2.3:o:cisco:asa_5525-x_firmware:009.015:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1CB81E9A-3CFF-406A-83D3-A62A650D1583"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EB71EB29-0115-4307-A9F7-262394FD9FB0"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5545-x_firmware:009.008:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2F1951B0-E631-475B-9AC2-DD3EFC842D37"
},
{
"criteria": "cpe:2.3:o:cisco:asa_5545-x_firmware:009.015:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D5054127-B933-4FBB-87D9-F90168ADE8A7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "57179F60-E330-4FF0-9664-B1E4637FF210"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5555-x_firmware:009.008:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5FCA70F5-B62E-449E-BFB5-FE52039A43CF"
},
{
"criteria": "cpe:2.3:o:cisco:asa_5555-x_firmware:009.015:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "603C4110-1A74-4698-9882-F23FF05803BE"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5535C936-391B-4619-AA03-B35265FC15D7"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5580_firmware:009.008:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6B105A6-008E-46E4-8789-C718962C1F46"
},
{
"criteria": "cpe:2.3:o:cisco:asa_5580_firmware:009.015:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5FB5240E-52F4-4A1E-8B5B-25A6446A2BF9"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D1E828B8-5ECC-4A09-B2AD-DEDC558713DE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asa_5585-x_firmware:009.008:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C662CBD3-FA7F-4BD4-8867-9796B38926A7"
},
{
"criteria": "cpe:2.3:o:cisco:asa_5585-x_firmware:009.015:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1234B4DC-4C8E-48B5-BD05-01843C8083D5"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "16AE20C2-C77E-4E04-BF13-A48696E52426"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@cisco.com"
}