Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-34749— Multiple Cisco Products Server Name Identification Data Exfiltration Vulnerability

Quick assessment

Affected
Cisco Cisco Web Security Appliance (WSA)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cisco Firepower Threat Defense（FTD）是美国思科（Cisco）公司的一套提供下一代防火墙服务的统一软件。 Cisco 多款产品存在信息泄露漏洞，该漏洞源于 SSL 握手的过滤不足。Cisco Web安全设备(WSA)、Cisco火力威胁防御(FTD)和Snort检测引擎的服务器名称识别(SNI)请求过滤漏洞可能允许未经身份验证的远程攻击者绕过受影响设备上的过滤技术，从受影响的主机窃取数据。

CVSS 5.8 · Medium EPSS 1.68% · P76
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-34749

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Multiple Cisco Products Server Name Identification Data Exfiltration Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from a compromised host. This vulnerability is due to inadequate filtering of the SSL handshake. An attacker could exploit this vulnerability by using data from the SSL client hello packet to communicate with an external server. A successful exploit could allow the attacker to execute a command-and-control attack on a compromised host and perform additional data exfiltration attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco Firepower Threat Defense 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Firepower Threat Defense（FTD）是美国思科（Cisco）公司的一套提供下一代防火墙服务的统一软件。 Cisco 多款产品存在信息泄露漏洞，该漏洞源于 SSL 握手的过滤不足。Cisco Web安全设备(WSA)、Cisco火力威胁防御(FTD)和Snort检测引擎的服务器名称识别(SNI)请求过滤漏洞可能允许未经身份验证的远程攻击者绕过受影响设备上的过滤技术，从受影响的主机窃取数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Cisco Cisco Web Security Appliance (WSA) n/a -

II. Public POCs for CVE-2021-34749

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-34749

请登录查看更多情报信息。

Vendor Advisories for CVE-2021-34749 (1)

Mailing List Discussions for CVE-2021-34749 (1)

Same Patch Batch · Cisco · 2021-08-18 · 7 CVEs total

CVE-2021-34730 9.8 CRITICAL Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution an
CVE-2021-34745 7.8 HIGH AppDynamics .NET Agent Privilege Escalation Vulnerability
CVE-2021-34716 6.7 MEDIUM Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution
CVE-2021-34734 6.5 MEDIUM Cisco Video Surveillance 7000 Series IP Cameras Link Layer Discovery Protocol Double-Free
CVE-2021-1561 5.4 MEDIUM Cisco Secure Email and Web Manager Spam Quarantine Unauthorized Access Vulnerability
CVE-2021-34715 4.7 MEDIUM Cisco Expressway Series and TelePresence Video Communication Server Image Verification Vu

IV. Related Vulnerabilities

Same product: Cisco Web Security Appliance (WSA)
Same vendor: Cisco
Same weakness: CWE-200

V. Comments for CVE-2021-34749

No comments yet

Leave a comment