Resource exhaustion in Cisco Asyncos
CVE-2021-34741
A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack against an affected device. This vulnerability is due to insufficient input validation of incoming emails. An attacker could exploit this vulnerability by sending a crafted email through Cisco ESA. A successful exploit could allow the attacker to exhaust all the available CPU resources on an affected device for an extended period of time, preventing other emails from being processed and resulting in a DoS condition.
EPSS: 0.013 (68.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Cisco Asyncos — versions 13.5.3-010, 13.7.0-093
- Cisco Email Security Appliance (Esa) — versions n/a
- Cisco M170
- Cisco M190
- Cisco M380
- Cisco M390
- Cisco M390x
- Cisco M680
- Cisco M690
- Cisco M690x
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-34741?
- CVE-2021-34741 is a high-severity vulnerability in Cisco Asyncos, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2021-11-04.
- How severe is CVE-2021-34741?
- High severity. CVSS v3 base score is 7.5 out of 10.