CVE-2021-40112 Cisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities
Unauthenticated remote attackers can execute arbitrary commands and modify configurations on Cisco Catalyst PON switches if Telnet is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-40112?
CVE-2021-40112 is a critical command injection vulnerability in Cisco Catalyst PON Series, published on 4 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory.
Weakness: CWE-284
Which versions are affected by CVE-2021-40112?
It affects 5 products.
Products include Cisco Catalyst Pon Switch Cgp-Ont-1p Firmware, Cisco Catalyst Pon Switch Cgp-Ont-4p Firmware, Cisco Catalyst Pon Switch Cgp-Ont-4pv Firmware, Cisco Catalyst Pon Switch Cgp-Ont-4pvc Firmware, Cisco Catalyst Pon Switch Cgp-Ont-4tvcw Firmware.
How do I fix CVE-2021-40112?
No fix has been published for CVE-2021-40112 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-40112 being exploited?
There is no known exploitation of CVE-2021-40112 in the wild and no public exploit code.
Other vulnerabilities in Cisco Catalyst PON Series
Sources
Also known as GHSA-xj98-pcc3-hvhq.