CVE-2021-34705: cisco cisco_ios Improper Handling of Undefined Values

Vulnerability summary

CVE-2021-34705 is a medium (CVSS 5.3) Improper Handling of Undefined Values vulnerability in cisco cisco_ios. EPSS estimates a 1.01% chance of exploitation in the next 30 days, higher than 62.3% of scored vulnerabilities.

Timeline

1. 23-09-2021
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the Voice Telephony Service Provider (VTSP) service of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured destination patterns and dial arbitrary numbers. This vulnerability is due to insufficient validation of dial strings at Foreign Exchange Office (FXO) interfaces. An attacker could exploit this vulnerability by sending a malformed dial string to an affected device via either the ISDN protocol or SIP. A successful exploit could allow the attacker to conduct toll fraud, resulting in unexpected financial impact to affected customers.

• CWE-232Improper Handling of Undefined ValuesThe product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.