CVE-2021-1367 : A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco NX-OS Software could allow an unauthenticat

A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted PIM packet to an affected device. A successful exploit could allow the attacker to cause a traffic loop, resulting in a DoS condition.

Published 2021-02-24 20:15:13

Updated 2021-03-09 19:21:15

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Input validationDenial of service

Exploit prediction scoring system (EPSS) score for CVE-2021-1367

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 23 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-1367

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.9	LOW	AV:A/AC:M/Au:N/C:N/I:N/A:P	5.5	2.9	NIST
Access Vector: Adjacent Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
4.3	MEDIUM	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	2.8	1.4	Cisco Systems, Inc.
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low
4.3	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	2.8	1.4	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low

CWE ids for CVE-2021-1367

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: ykramarz@cisco.com (Primary)

Products affected by CVE-2021-1367

Cisco » Nx-os » Version: 9.3(5)
cpe:2.3:o:cisco:nx-os:9.3\(5\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 9000v Switch » Version: N/A
When used together with: Cisco » Nexus 92160yc-x Switch » Version: N/A
When used together with: Cisco » Nexus 92300yc Switch » Version: N/A
When used together with: Cisco » Nexus 92304qc Switch » Version: N/A
When used together with: Cisco » Nexus 92348gc-x Switch » Version: N/A
When used together with: Cisco » Nexus 9236c Switch » Version: N/A
When used together with: Cisco » Nexus 9272q Switch » Version: N/A
When used together with: Cisco » Nexus 93108tc-ex-24 Switch » Version: N/A
When used together with: Cisco » Nexus 93108tc-ex Switch » Version: N/A
When used together with: Cisco » Nexus 93108tc-fx-24 » Version: N/A
When used together with: Cisco » Nexus 93108tc-fx Switch » Version: N/A
When used together with: Cisco » Nexus 93120tx » Version: N/A
When used together with: Cisco » Nexus 93128tx » Version: N/A
When used together with: Cisco » Nexus 9316d-gx » Version: N/A
When used together with: Cisco » Nexus 93180lc-ex » Version: N/A
When used together with: Cisco » Nexus 93180yc-ex » Version: N/A
When used together with: Cisco » Nexus 93180yc-ex-24 » Version: N/A
When used together with: Cisco » Nexus 93180yc-fx » Version: N/A
When used together with: Cisco » Nexus 93180yc-fx-24 » Version: N/A
When used together with: Cisco » Nexus 93180yc-fx3 » Version: N/A
When used together with: Cisco » Nexus 93180yc-fx3s » Version: N/A
When used together with: Cisco » Nexus 93216tc-fx2 » Version: N/A
When used together with: Cisco » Nexus 93240yc-fx2 » Version: N/A
When used together with: Cisco » Nexus 9332c » Version: N/A
When used together with: Cisco » Nexus 9332pq » Version: N/A
When used together with: Cisco » Nexus 93360yc-fx2 » Version: N/A
When used together with: Cisco » Nexus 9336c-fx2 » Version: N/A
When used together with: Cisco » Nexus 9336c-fx2-e » Version: N/A
When used together with: Cisco » Nexus 9336pq » Version: N/A
When used together with: Cisco » Nexus 9348gc-fxp » Version: N/A
When used together with: Cisco » Nexus 93600cd-gx » Version: N/A
When used together with: Cisco » Nexus 9364c » Version: N/A
When used together with: Cisco » Nexus 9364c-gx » Version: N/A
When used together with: Cisco » Nexus 9372px » Version: N/A
When used together with: Cisco » Nexus 9372px-e » Version: N/A
When used together with: Cisco » Nexus 9372tx » Version: N/A
When used together with: Cisco » Nexus 9372tx-e » Version: N/A
When used together with: Cisco » Nexus 9396px » Version: N/A
When used together with: Cisco » Nexus 9396tx » Version: N/A
When used together with: Cisco » Nexus 9504 » Version: N/A
When used together with: Cisco » Nexus 9508 » Version: N/A
When used together with: Cisco » Nexus 9516 » Version: N/A

Vulnerability Details : CVE-2021-1367

Exploit prediction scoring system (EPSS) score for CVE-2021-1367

CVSS scores for CVE-2021-1367

CWE ids for CVE-2021-1367

References for CVE-2021-1367

Products affected by CVE-2021-1367