CVE-2021-34754: cisco cisco firepower threat defense software Improper Access Control

Vulnerability summary

CVE-2021-34754 is a high (CVSS 7.5) Improper Access Control vulnerability in cisco cisco firepower threat defense software. EPSS estimates a 1.01% chance of exploitation in the next 30 days, higher than 62.3% of scored vulnerabilities.

Timeline

1. 27-10-2021
   PublishedVulnerability first disclosed.
2. 07-11-2024
   Last modifiedVulnerability information updated.

Description

Multiple vulnerabilities in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. These vulnerabilities are due to incomplete processing during deep packet inspection for ENIP packets. An attacker could exploit these vulnerabilities by sending a crafted ENIP packet to the targeted interface. A successful exploit could allow the attacker to bypass configured access control and intrusion policies that should be activated for the ENIP packet.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.