CVE-2021-34757 : Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator

Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or reconfigure the passwords on the user account. For more information about these vulnerabilities, see the Details section of this advisory.

Published 2021-10-06 20:15:11

Updated 2022-10-24 14:26:37

Source Cisco Systems, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-34757

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 10 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-34757

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.6	LOW	AV:L/AC:L/Au:N/C:P/I:P/A:N	3.9	4.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
4.9	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	1.2	3.6	Cisco Systems, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.5	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N	0.3	5.2	NIST
Attack Vector: Physical Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2021-34757

CWE-540 Inclusion of Sensitive Information in Source Code

Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.

Assigned by: ykramarz@cisco.com (Secondary)

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2021-34757

Cisco » Business 220-8t-e-2g Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-8t-e-2g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-8t-e-2g » Version: N/A
Cisco » Business 220-8p-e-2g Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-8p-e-2g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-8p-e-2g » Version: N/A
Cisco » Business 220-8fp-e-2g Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-8fp-e-2g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-8fp-e-2g » Version: N/A
Cisco » Business 220-16t-2g Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-16t-2g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-16t-2g » Version: N/A
Cisco » Business 220-16p-2g Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-16p-2g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-16p-2g » Version: N/A
Cisco » Business 220-24t-4g Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-24t-4g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-24t-4g » Version: N/A
Cisco » Business 220-24p-4g Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-24p-4g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-24p-4g » Version: N/A
Cisco » Business 220-24fp-4g Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-24fp-4g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-24fp-4g » Version: N/A
Cisco » Business 220-48t-4g Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-48t-4g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-48t-4g » Version: N/A
Cisco » Business 220-48p-4g Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-48p-4g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-48p-4g » Version: N/A
Cisco » Business 220-24t-4x Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-24t-4x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-24t-4x » Version: N/A
Cisco » Business 220-24p-4x Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-24p-4x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-24p-4x » Version: N/A
Cisco » Business 220-24fp-4x Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-24fp-4x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-24fp-4x » Version: N/A
Cisco » Business 220-48t-4x Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-48t-4x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-48t-4x » Version: N/A
Cisco » Business 220-48p-4x Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-48p-4x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-48p-4x » Version: N/A
Cisco » Business 220-48fp-4x Firmware
Versions up to, including, (<=) 1.2.0.6
cpe:2.3:o:cisco:business_220-48fp-4x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Business 220-48fp-4x » Version: N/A

Vulnerability Details : CVE-2021-34757

Exploit prediction scoring system (EPSS) score for CVE-2021-34757

CVSS scores for CVE-2021-34757

CWE ids for CVE-2021-34757

References for CVE-2021-34757

Products affected by CVE-2021-34757