What is the CVSS score of CVE-2021-40112?

CVE-2021-40112 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 1.4%.

Is there a patch available for CVE-2021-40112?

Yes, a patch is available for CVE-2021-40112. Update the affected software to the latest version immediately.

Catalyst Pon Switch Cgp Ont 1P Firmware CVE-2021-40112

HIGH

Improper Access Control (CWE-284)

2021-11-04 psirt@cisco.com

Cisco Command Injection Authentication Bypass Catalyst Pon Switch Cgp Ont 1P Firmware Catalyst Pon Switch Cgp Ont 4P Firmware Catalyst Pon Switch Cgp Ont 4Pvc Firmware Catalyst Pon Switch Cgp Ont 4Tvcw Firmware Catalyst Pon Switch Cgp Ont 4Pv Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Nov 04, 2021 - 16:15 nvd

HIGH 7.5

DescriptionNVD

Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory.

AnalysisAI

Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-284. Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory. Affected products include: Cisco Catalyst Pon Switch Cgp-Ont-1P Firmware, Cisco Catalyst Pon Switch Cgp-Ont-4P Firmware, Cisco Catalyst Pon Switch Cgp-Ont-4Pvc Firmware, Cisco Catalyst Pon Switch Cgp-Ont-4Tvcw Firmware, Cisco Catalyst Pon Switch Cgp-Ont-4Pv Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.