CVE-2021-34735

Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting in remote code execution or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS v3 7.5 HIGH
CVSS v2.0 7.8 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-A4J57F3	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:h:cisco:ata_190:-:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ata_190_firmware:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:h:cisco:ata_191:-:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ata_191_firmware:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:h:cisco:ata_192:-:*:*:*:*:*:*:*

cpe:2.3:o:cisco:ata_192_firmware:-:*:*:*:*:*:*:*

History

07 Jul 2023, 19:12

Type	Values Removed	Values Added
CWE	~~CWE-77~~	NVD-CWE-Other

Information

Published : 2021-10-06 20:15

Updated : 2024-02-28 18:48

NVD link : CVE-2021-34735

Mitre link : CVE-2021-34735

CVE.ORG link : CVE-2021-34735

JSON object : View

Products Affected

cisco

ata_192_firmware
ata_190
ata_192
ata_190_firmware
ata_191
ata_191_firmware

CWE

NVD-CWE-Other CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2021-34735", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-10-06T20:15:09.863", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-A4J57F3", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting in remote code execution or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades en el Software de Cisco ATA 190 Series Analog Telephone Adapter podr\u00edan permitir a un atacante llevar a cabo un ataque de inyecci\u00f3n de comandos resultando en una ejecuci\u00f3n de c\u00f3digo remota o causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en un dispositivo afectado. Para obtener m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Details de este aviso"}], "lastModified": "2023-11-07T03:36:14.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:ata_190:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "03D95BDC-0525-40E6-9D4F-6ED7464827C6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ata_190_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEF2E6B9-E909-44F3-86A6-2F3D887461A4"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:ata_191:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "98A2874F-F45B-4F22-8966-FBFE2D8DC5FF"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ata_191_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BECF8A6-C1BB-4337-9C2B-C1C4EA5AE28F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:ata_192:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2EE9F364-54F2-4D63-9E3F-468FEB7F5BFD"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ata_192_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90B16610-1B92-4E79-8681-FBD59301A0D7"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}