CVE-2021-34794 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SNMP Access Control Vulnerability
An unauthenticated remote attacker with valid credentials can bypass SNMP access controls to retrieve sensitive device information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34794?
CVE-2021-34794 is a medium-severity missing authorization vulnerability in Cisco Adaptive Security Appliance Software, published on 27 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the Simple Network Management Protocol version 3 (SNMPv3) access control functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to query SNMP data. This vulnerability is due to ineffective access control. An attacker could exploit this vulnerability by sending an SNMPv3 query to an affected device from a host that is not permitted by the SNMPv3 access control list. A successful exploit could allow the attacker to send an SNMP query to an affected device and retrieve information from the device. The attacker would need valid credentials to perform the SNMP query.
Weakness: CWE-284
Which versions are affected by CVE-2021-34794?
It affects 10 products.
Products include Cisco Adaptive Security Appliance Software, Cisco Asa 5505 Firmware, Cisco Asa 5512-X Firmware, Cisco Asa 5515-X Firmware, Cisco Asa 5525-X Firmware, Cisco Asa 5545-X Firmware and 4 more.
How do I fix CVE-2021-34794?
No fix has been published for CVE-2021-34794 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-34794 being exploited?
There is no known exploitation of CVE-2021-34794 in the wild and no public exploit code.
Other vulnerabilities in Cisco Adaptive Security Appliance Software
- CVE-2025-20333 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow
- CVE-2016-6366 Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow
- CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection
- CVE-2024-20353 Cisco ASA and FTD Denial of Service
- CVE-2016-6367 Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution
All Cisco Adaptive Security Appliance Software vulnerabilities
Sources
Also known as GHSA-24fh-2pfj-hp74.