What is the CVSS score of CVE-2021-34775?

CVE-2021-34775 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.4%.

Business 220 8T E 2G Firmware CVE-2021-34775

MEDIUM

Classic Buffer Overflow (CWE-120)

2021-10-06 psirt@cisco.com

Buffer Overflow Cisco Business 220 8T E 2G Firmware Business 220 8P E 2G Firmware Business 220 8Fp E 2G Firmware Business 220 16T 2G Firmware Business 220 16P 2G Firmware Business 220 24T 4G Firmware Business 220 24P 4G Firmware Business 220 24Fp 4G Firmware Business 220 48T 4G Firmware Business 220 48P 4G Firmware Business 220 24T 4X Firmware Business 220 24P 4X Firmware Business 220 24Fp 4X Firmware Business 220 48T 4X Firmware Business 220 48P 4X Firmware Business 220 48Fp 4X Firmware

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Oct 06, 2021 - 20:15 nvd

MEDIUM 4.3

DescriptionNVD

Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches. An unauthenticated, adjacent attacker could perform the following: Execute code on the affected device or cause it to reload unexpectedly Cause LLDP database corruption on the affected device For more information about these vulnerabilities, see the Details section of this advisory. Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). Cisco has released firmware updates that address these vulnerabilities.

AnalysisAI

Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Buffer Copy without Size Check (CWE-120), which allows attackers to overflow a buffer to corrupt adjacent memory. Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches. An unauthenticated, adjacent attacker could perform the following: Execute code on the affected device or cause it to reload unexpectedly Cause LLDP database corruption on the affected device For more information about these vulnerabilities, see the Details section of this advisory. Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). Cisco has released firmware updates that address these vulnerabilities. Affected products include: Cisco Business 220-8T-E-2G Firmware, Cisco Business 220-8P-E-2G Firmware, Cisco Business 220-8Fp-E-2G Firmware, Cisco Business 220-16T-2G Firmware, Cisco Business 220-16P-2G Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Always validate buffer sizes before copy operations. Use bounded functions (strncpy, snprintf). Enable compiler protections.