Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

CVE-2021-1616

Cisco IOS XE Software H.323 Application Level Gateway Bypass Vulnerability

MEDIUM 4.7

En bref

Source
NVD
EPSS
EPSS 1.19 % · centile 68 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
cisco
Statut NVD
Modified

Description

A vulnerability in the H.323 application level gateway (ALG) used by the Network Address Translation (NAT) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass the ALG. This vulnerability is due to insufficient data validation of traffic that is traversing the ALG. An attacker could exploit this vulnerability by sending crafted traffic to a targeted device. A successful exploit could allow the attacker to bypass the ALG and open connections that should not be allowed to a remote device located behind the ALG. Note: This vulnerability has been publicly discussed as NAT Slipstreaming.

Faiblesses (CWE)

  • CWE-693 — Défaillance du mécanisme de protection

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 4.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:Ncisco
CVSS 3.1MEDIUM 4.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:NNVD · psirt@cisco.com (Secondary)
CVSS 3.1MEDIUM 4.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:NNVD · nvd@nist.gov (Primary)
CVSS 2.0MEDIUM 4.3AV:N/AC:M/Au:N/C:N/I:P/A:NNVD · nvd@nist.gov (Primary)

Références européennes

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Cisco · Cisco IOS XE Softwareaffected n/a

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD