Vulnerability Description
A vulnerability in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass NETCONF or RESTCONF authentication and do either of the following: Install, manipulate, or delete the configuration of an affected device Cause memory corruption that results in a denial of service (DoS) on an affected device This vulnerability is due to an uninitialized variable. An attacker could exploit this vulnerability by sending a series of NETCONF or RESTCONF requests to an affected device. A successful exploit could allow the attacker to use NETCONF or RESTCONF to install, manipulate, or delete the configuration of a network device or to corrupt memory on the device, resulting a DoS.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ios Xe | 16.3.1 |
| Cisco | Ios Xe Sd-Wan | All versions |
| Cisco | Ios Xe Sd-Wan 16.10.1 When Installed On 1000 Series Integrated Services | routers |
| Cisco | Ios Xe Sd-Wan 16.10.1 When Installed On 4000 Series Integrated Services | routers |
| Cisco | Ios Xe Sd-Wan 16.10.1 When Installed On Asr 1000 Series Aggregation Services | routers |
| Cisco | Ios Xe Sd-Wan 16.10.1 When Installed On Integrated Services Virtual | router |
| Cisco | Ios Xe Sd-Wan 16.10.2 When Installed On 1000 Series Integrated Services | routers |
| Cisco | Ios Xe Sd-Wan 16.10.2 When Installed On 4000 Series Integrated Services | routers |
| Cisco | Ios Xe Sd-Wan 16.10.2 When Installed On Asr 1000 Series Aggregation Services | routers |
| Cisco | Ios Xe Sd-Wan 16.10.2 When Installed On Integrated Services Virtual | router |
| Cisco | Ios Xe Sd-Wan 16.10.3 When Installed On 1000 Series Integrated Services | routers |
| Cisco | Ios Xe Sd-Wan 16.10.3 When Installed On 4000 Series Integrated Services | routers |
| Cisco | Ios Xe Sd-Wan 16.10.3 When Installed On Asr 1000 Series Aggregation Services | routers |
| Cisco | Ios Xe Sd-Wan 16.10.3 When Installed On Integrated Services Virtual | router |
| Cisco | Ios Xe Sd-Wan 16.10.3A When Installed On 1000 Series Integrated Services | routers |
| Cisco | Ios Xe Sd-Wan 16.10.3A When Installed On 4000 Series Integrated Services | routers |
| Cisco | Ios Xe Sd-Wan 16.10.3A When Installed On Asr 1000 Series Aggregation Services | routers |
| Cisco | Ios Xe Sd-Wan 16.10.3A When Installed On Cloud Services Router 1000V | series |
| Cisco | Ios Xe Sd-Wan 16.10.3A When Installed On Integrated Services Virtual | router |
| Cisco | Ios Xe Sd-Wan 16.10.3B When Installed On 1000 Series Integrated Services | routers |
Related Weaknesses (CWE)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aVendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aVendor Advisory
FAQ
What is CVE-2021-1619?
CVE-2021-1619 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A vulnerability in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass NETCONF or RESTCONF authenticatio...
How severe is CVE-2021-1619?
CVE-2021-1619 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-1619?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ios Xe, Cisco Ios Xe Sd-Wan, Cisco Ios Xe Sd-Wan 16.10.1 When Installed On 1000 Series Integrated Services, Cisco Ios Xe Sd-Wan 16.10.1 When Installed On 4000 Series Integrated Services, Cisco Ios Xe Sd-Wan 16.10.1 When Installed On Asr 1000 Series Aggregation Services.