Vulnerability · Published Oct 6, 2021 · Assigned by cisco

CVE-2021-34779Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabilities

Medium 4.3

In plain English

A medium-severity buffer overflow in Cisco Small Business 200 Series Smart Switches from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 55.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches. An unauthenticated, adjacent attacker could perform the following: Execute code on the affected device or cause it to reload unexpectedly Cause LLDP database corruption on the affected device For more information about these vulnerabilities, see the Details section of this advisory. Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). Cisco has released firmware updates that address these vulnerabilities.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Small Business 200 Series Smart Switches	n/a

Weakness: CWE-120 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

20211006 Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabilities vendor-advisory, x_refsource_CISCO