Skip to content
Fencer Vulns
medium 4.3

CVE-2021-1220 json

Cisco IOS XE Software Web UI Denial of Service Vulnerabilities

published 2021-03-24 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-6687

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits
0
none known

Summary

Multiple vulnerabilities in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to cause the web UI software to become unresponsive and consume vty line instances, resulting in a denial of service (DoS) condition. These vulnerabilities are due to insufficient error handling in the web UI. An attacker could exploit these vulnerabilities by sending crafted HTTP packets to an affected device. A successful exploit could allow the attacker to cause the web UI software to become unresponsive and consume all available vty lines, preventing new session establishment and resulting in a DoS condition. Manual intervention would be required to regain web UI and vty session functionality. Note: These vulnerabilities do not affect the console connection.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-110-02 updated cvss 5.5

ICSA-21-110-02_Rockwell Automation Stratix Switches

  • Rockwell Automation Stratix 5400 <= 15.2(7)E3 Rockwell Automation Stratix 5410 <= 15.2(7)E3 Rockwell Automation Stratix 5700 <= 15.2(7)E3 Rockwell Automation Stratix 5800 <= 16.12.01 Rockwell Automation Stratix 8000 <= 15.2(7)E3
    affected: vendor fix, mitigation “Rockwell Automation encourages users of the affected Stratix devices to update to an available firmware revision that addresses the associated risk.” rockwellautomation.custhelp.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.98% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD 2.0 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P

Affected products

  • Cisco Cisco IOS XE Software

Classification

Weakness
  • CWE-20 Improper Input Validation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.