CVE-2021-34718

 

Published at: - 09-09-2021 07:15

Last modified: - 25-01-2023 07:37

Total changes: - 3

Description

A vulnerability in the SSH Server process of Cisco IOS XR Software could allow an authenticated, remote attacker to overwrite and read arbitrary files on the local device. This vulnerability is due to insufficient input validation of arguments that are supplied by the user for a specific file transfer method. An attacker with lower-level privileges could exploit this vulnerability by specifying Secure Copy Protocol (SCP) parameters when authenticating to a device. A successful exploit could allow the attacker to elevate their privileges and retrieve and upload files on a device that they should not have access to.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

 

Verification logic

 

Reference

• 20210908 Cisco IOS XR Software Arbitrary File Read and Write Vulnerability-Vendor Advisory

 

Keywords

NVD

 

CVE-2021-34718

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures