Vulnerability Details : CVE-2021-34741

A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack against an affected device. This vulnerability is due to insufficient input validation of incoming emails. An attacker could exploit this vulnerability by sending a crafted email through Cisco ESA. A successful exploit could allow the attacker to exhaust all the available CPU resources on an affected device for an extended period of time, preventing other emails from being processed and resulting in a DoS condition.
Published 2021-11-04 16:15:09
Updated 2022-10-27 16:42:12
Source Cisco Systems, Inc.
View at NVD,   CVE.org
Vulnerability category: Denial of service

Products affected by CVE-2021-34741

  • Cisco » Asyncos
    Versions before (<) 13.0.4
    cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*
    Matching versions
    When used together with: Cisco » M170 » Version: N/A
    When used together with: Cisco » M190 » Version: N/A
    When used together with: Cisco » M380 » Version: N/A
    When used together with: Cisco » M390 » Version: N/A
    When used together with: Cisco » M390x » Version: N/A
    When used together with: Cisco » M680 » Version: N/A
    When used together with: Cisco » M690 » Version: N/A
    When used together with: Cisco » M690x » Version: N/A
    When used together with: Cisco » S195 » Version: N/A
    When used together with: Cisco » S395 » Version: N/A
    When used together with: Cisco » S695 » Version: N/A
  • Cisco » Asyncos » Version: 13.5.3-010
    cpe:2.3:o:cisco:asyncos:13.5.3-010:*:*:*:*:*:*:*
    Matching versions
    When used together with: Cisco » M170 » Version: N/A
    When used together with: Cisco » M190 » Version: N/A
    When used together with: Cisco » M380 » Version: N/A
    When used together with: Cisco » M390 » Version: N/A
    When used together with: Cisco » M390x » Version: N/A
    When used together with: Cisco » M680 » Version: N/A
    When used together with: Cisco » M690 » Version: N/A
    When used together with: Cisco » M690x » Version: N/A
    When used together with: Cisco » S195 » Version: N/A
    When used together with: Cisco » S395 » Version: N/A
    When used together with: Cisco » S695 » Version: N/A
  • Cisco » Asyncos » Version: 13.7.0-093
    cpe:2.3:o:cisco:asyncos:13.7.0-093:*:*:*:*:*:*:*
    Matching versions
    When used together with: Cisco » M170 » Version: N/A
    When used together with: Cisco » M190 » Version: N/A
    When used together with: Cisco » M380 » Version: N/A
    When used together with: Cisco » M390 » Version: N/A
    When used together with: Cisco » M390x » Version: N/A
    When used together with: Cisco » M680 » Version: N/A
    When used together with: Cisco » M690 » Version: N/A
    When used together with: Cisco » M690x » Version: N/A
    When used together with: Cisco » S195 » Version: N/A
    When used together with: Cisco » S395 » Version: N/A
    When used together with: Cisco » S695 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2021-34741

EPSS FAQ
0.24%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 44 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-34741

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
5.0
 MEDIUM AV:N/AC:L/Au:N/C:N/I:N/A:P
10.0
2.9
 NIST
7.5
 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.9
3.6
 Cisco Systems, Inc.
7.5
 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.9
3.6
 NIST

CWE ids for CVE-2021-34741

  • The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
    Assigned by:
    • nvd@nist.gov (Primary)
    • ykramarz@cisco.com (Secondary)

References for CVE-2021-34741

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close