CVE-2021-34741 Cisco Email Security Appliance Denial of Service Vulnerability

High 7.5 Published 4 Nov 2021 Updated 7 Nov 2024

Unauthenticated remote attackers can cause a denial of service on Cisco Email Security Appliances by sending crafted emails that exhaust CPU resources.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-34741?

CVE-2021-34741 is a high-severity denial of service vulnerability in Cisco Asyncos, published on 4 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack against an affected device. This vulnerability is due to insufficient input validation of incoming emails. An attacker could exploit this vulnerability by sending a crafted email through Cisco ESA. A successful exploit could allow the attacker to exhaust all the available CPU resources on an affected device for an extended period of time, preventing other emails from being processed and resulting in a DoS condition.

Weakness: CWE-770

Which versions are affected by CVE-2021-34741?

It affects 1 product.

Products include Cisco Asyncos.

How do I fix CVE-2021-34741?

No fix has been published for CVE-2021-34741 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-34741 being exploited?

There is no known exploitation of CVE-2021-34741 in the wild and no public exploit code.

All Cisco Asyncos vulnerabilities

Sources

Also known as GHSA-mcrm-m53h-jvp2.