Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-34741

A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack against an affected device. This vulnerability is due to insufficient input validation of incoming emails. An attacker could exploit this vulnerability by sending a crafted email through Cisco ESA. A successful exploit could allow the attacker to exhaust all the available CPU resources on an affected device for an extended period of time, preventing other emails from being processed and resulting in a DoS condition.

Published

2021-11-04T16:15:08.660

Last Modified

2024-11-21T06:11:05.927

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-770
  • Type: Primary
    CWE-770
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System cisco asyncos < 13.0.4 Yes
Operating System cisco asyncos 13.5.3-010 Yes
Operating System cisco asyncos 13.7.0-093 Yes
Hardware cisco m170 - No
Hardware cisco m190 - No
Hardware cisco m380 - No
Hardware cisco m390 - No
Hardware cisco m390x - No
Hardware cisco m680 - No
Hardware cisco m690 - No
Hardware cisco m690x - No
Hardware cisco s195 - No
Hardware cisco s395 - No
Hardware cisco s695 - No
References