CVE-2021-1445: cisco adaptive_security_appliance_software Out-of-bounds Write

Vulnerability summary

CVE-2021-1445 is a high (CVSS 8.6) Out-of-bounds Write vulnerability in cisco adaptive_security_appliance_software. EPSS estimates a 1.66% chance of exploitation in the next 30 days, higher than 76.2% of scored vulnerabilities.

Timeline

1. 29-04-2021
   PublishedVulnerability first disclosed.
2. 08-11-2024
   Last modifiedVulnerability information updated.

Description

Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. These vulnerabilities are due to lack of proper input validation of the HTTPS request. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.