CVE-2021-1625 Cisco IOS XE Software Zone-Based Policy Firewall ICMP and UDP Inspection Vulnerability

Medium 5.8 Published 23 Sep 2021 Updated 7 Nov 2024

Remote attackers can bypass Zone-Based Policy Firewall inspection when UTD or AppQoE is enabled, allowing unauthorized traffic injection or incorrect logging.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-1625?

CVE-2021-1625 is a medium-severity vulnerability in Cisco Ios Xe, published on 23 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the Zone-Based Policy Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent the Zone-Based Policy Firewall from correctly classifying traffic. This vulnerability exists because ICMP and UDP responder-to-initiator flows are not inspected when the Zone-Based Policy Firewall has either Unified Threat Defense (UTD) or Application Quality of Experience (AppQoE) configured. An attacker could exploit this vulnerability by attempting to send UDP or ICMP flows through the network. A successful exploit could allow the attacker to inject traffic through the Zone-Based Policy Firewall, resulting in traffic being dropped because it is incorrectly classified or in incorrect reporting figures being produced by high-speed logging (HSL).

Weakness: CWE-284

Which versions are affected by CVE-2021-1625?

It affects 1 product.

Products include Cisco Ios Xe.

How do I fix CVE-2021-1625?

No fix has been published for CVE-2021-1625 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-1625 being exploited?

There is no known exploitation of CVE-2021-1625 in the wild and no public exploit code.

All Cisco Ios Xe vulnerabilities

Sources

Also known as GHSA-w3v7-hj7c-4j8f.