Vulnerability in Cisco Adaptive Security Appliance
CVE-2021-34793
A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent mode could allow an unauthenticated, remote attacker to poison MAC address tables, resulting in a denial of service (DoS) vulnerability. This vulnerability is due to incorrect handling of certain TCP segments when the affected device is operating in transparent mode. An attacker could exploit this vulnerability by sending a crafted TCP segment through an affected device. A successful exploit could allow the attacker to poison the MAC address tables in adjacent devices, resulting in network disruption.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.006 (47.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 47.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Cisco Adaptive Security Appliance
- Cisco Adaptive Security Appliance Software
- Cisco Asa 5505
- Cisco Asa 5505 Firmware — versions 009.008(004.025), 009.008\(004.025\)
- Cisco Asa 5512-X
- Cisco Asa 5512-X Firmware — versions 009.008(004.025), 009.008\(004.025\)
- Cisco Asa 5515-X
- Cisco Asa 5515-X Firmware — versions 009.008(004.025), 009.008\(004.025\)
- Cisco Asa 5525-X
- Cisco Asa 5525-X Firmware — versions 009.008(004.025), 009.008\(004.025\)
Weakness classification (CWE)
References
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-… (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-34793?
- CVE-2021-34793 is a high-severity vulnerability in Cisco Adaptive Security Appliance, classified under Improper Enforcement of Message Integrity During Transmission in a Communication Channel. CVSS score: 8.6/10. Published 2021-10-27.
- How severe is CVE-2021-34793?
- High severity. CVSS v3 base score is 8.6 out of 10.