CVE-2021-1424

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability in the ipsecmgr process of Cisco ASR 5000 Series Software (StarOS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to insufficient validation of incoming Internet Key Exchange Version 2 (IKEv2) packets. An attacker could exploit this vulnerability by sending specifically malformed IKEv2 packets to an affected device. A successful exploit could allow the attacker to cause the ipsecmgr process to restart, which would disrupt ongoing IKE negotiations and result in a temporary DoS condition.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Cisco	Cisco ASR 5000 Series Software	21.15.7; 21.13.10; 21.14.1; 21.11.5; 21.13.8; 21.14.5; 21.12.8; 21.13.11; 21.11.8; 21.12.9; 21.15.5; 21.11.7; 21.13.5; 21.12.0; 21.15.2; 21.11.6; 21.14.2; 21.12.3; 21.15.0; 21.11.2
cisco	asr_5000_series_software	21.15.7; 21.13.10; 21.14.1; 21.11.5; 21.13.8; 21.14.5; 21.12.8; 21.13.11; 21.11.8; 21.12.9; 21.15.5; 21.11.7; 21.13.5; 21.12.0; 21.15.2; 21.11.6; 21.14.2; 21.12.3; 21.15.0; 21.11.2

References

Timeline

Published: Nov 18, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2021

CVE-2021-14256.5A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (S CVE-2021-14267.8Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow CVE-2021-14277.8Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow CVE-2021-14287.8Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow CVE-2021-14297.8Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow CVE-2021-14307.8Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow CVE-2021-14317.5A vulnerability in the vDaemon process of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to CVE-2021-14327.3A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands on the CVE-2021-14338.1A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a buffer ove CVE-2021-14346.0A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the CVE-2021-14357.2A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can b CVE-2021-14364.4A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to conduct path traversal attacks an