Vulnerability · Published Sep 23, 2021 · Assigned by cisco

CVE-2021-34727Cisco IOS XE SD-WAN Software Buffer Overflow Vulnerability

Critical 9.8

In plain English

A critical-severity buffer overflow in Cisco IOS XE SD-WAN Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.6%top 14.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. This vulnerability is due to insufficient bounds checking when an affected device processes traffic. An attacker could exploit this vulnerability by sending crafted traffic to the device. A successful exploit could allow the attacker to cause a buffer overflow and possibly execute arbitrary commands with root-level privileges, or cause the device to reload, which could result in a denial of service condition.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco IOS XE SD-WAN Software	n/a

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

20210922 Cisco IOS XE SD-WAN Software Buffer Overflow Vulnerability vendor-advisory, x_refsource_CISCO