CVE-2021-1227 : A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an una

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the NX-API on an affected device. An attacker could exploit this vulnerability by persuading a user of the NX-API to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. The attacker could view and modify the device configuration. Note: The NX-API feature is disabled by default.

Published 2021-02-24 20:15:12

Updated 2021-03-03 15:35:18

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Cross-site request forgery (CSRF)

Products affected by CVE-2021-1227

Cisco » Nx-os » Version: 8.4(2a)
cpe:2.3:o:cisco:nx-os:8.4\(2a\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Mds 9148s » Version: N/A
When used together with: Cisco » Mds 9250i » Version: N/A
When used together with: Cisco » Mds 9706 » Version: N/A
When used together with: Cisco » Mds 9710 » Version: N/A
When used together with: Cisco » Nexus 7000 » Version: N/A
When used together with: Cisco » Nexus 7700 » Version: N/A
Cisco » Nx-os » Version: 8.4(3)
cpe:2.3:o:cisco:nx-os:8.4\(3\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Mds 9148s » Version: N/A
When used together with: Cisco » Mds 9250i » Version: N/A
When used together with: Cisco » Mds 9706 » Version: N/A
When used together with: Cisco » Mds 9710 » Version: N/A
When used together with: Cisco » Nexus 7000 » Version: N/A
When used together with: Cisco » Nexus 7700 » Version: N/A
Cisco » Nx-os » Version: 8.4(3)s19
cpe:2.3:o:cisco:nx-os:8.4\(3\)s19:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Mds 9148s » Version: N/A
When used together with: Cisco » Mds 9250i » Version: N/A
When used together with: Cisco » Mds 9706 » Version: N/A
When used together with: Cisco » Mds 9710 » Version: N/A
When used together with: Cisco » Nexus 7000 » Version: N/A
When used together with: Cisco » Nexus 7700 » Version: N/A
Cisco » Nx-os » Version: 9.3(3)idi9(0.569)
cpe:2.3:o:cisco:nx-os:9.3\(3\)idi9\(0.569\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 3048 » Version: N/A
When used together with: Cisco » Nexus 31108pv-v » Version: N/A
When used together with: Cisco » Nexus 31108tc-v » Version: N/A
When used together with: Cisco » Nexus 31128pq » Version: N/A
When used together with: Cisco » Nexus 3132c-z » Version: N/A
When used together with: Cisco » Nexus 3132q-v » Version: N/A
When used together with: Cisco » Nexus 3132q-x » Version: N/A
When used together with: Cisco » Nexus 3132q-xl » Version: N/A
When used together with: Cisco » Nexus 3164q » Version: N/A
When used together with: Cisco » Nexus 3172pq » Version: N/A
When used together with: Cisco » Nexus 3172pq-xl » Version: N/A
When used together with: Cisco » Nexus 3232c » Version: N/A
When used together with: Cisco » Nexus 3264c-e » Version: N/A
When used together with: Cisco » Nexus 3264q » Version: N/A
When used together with: Cisco » Nexus 3408-s » Version: N/A
When used together with: Cisco » Nexus 34180yc » Version: N/A
When used together with: Cisco » Nexus 3432d-s » Version: N/A
When used together with: Cisco » Nexus 3464c » Version: N/A
When used together with: Cisco » Nexus 3524-x » Version: N/A
When used together with: Cisco » Nexus 3524-xl » Version: N/A
When used together with: Cisco » Nexus 3548-x » Version: N/A
When used together with: Cisco » Nexus 3548-xl » Version: N/A
When used together with: Cisco » Nexus 36180yc-r » Version: N/A
When used together with: Cisco » Nexus 3636c-r » Version: N/A
When used together with: Cisco » Nexus 9200 » Version: N/A
When used together with: Cisco » Nexus 9300 » Version: N/A
When used together with: Cisco » Nexus 9500 » Version: N/A
Cisco » Nx-os » Version: 7.3(8)n1(0.809)
cpe:2.3:o:cisco:nx-os:7.3\(8\)n1\(0.809\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 5548p » Version: N/A
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5672up-16g » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
When used together with: Cisco » Nexus 6001 » Version: N/A
When used together with: Cisco » Nexus 6004 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2021-1227

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 35 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-1227

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:N	8.6	4.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
8.1	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	2.8	5.2	Cisco Systems, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: None
8.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	2.8	5.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2021-1227

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Assigned by: ykramarz@cisco.com (Primary)

References for CVE-2021-1227

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nxapi-csrf-wRMzWL9z

Cisco NX-OS Software NX-API Cross-Site Request Forgery Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2021-1227

Products affected by CVE-2021-1227

Exploit prediction scoring system (EPSS) score for CVE-2021-1227

CVSS scores for CVE-2021-1227

CWE ids for CVE-2021-1227

References for CVE-2021-1227