Cisco Security Advisory
Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021
Click Icon to Copy Verbose Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:X/RL:X/RC:X
-
On March 25, 2021, the OpenSSL Project released a security advisory, OpenSSL Security Advisory [25 March 2021], that disclosed two vulnerabilities.
Exploitation of these vulnerabilities could allow an attacker to use a valid non-certificate authority (CA) certificate to act as a CA and sign a certificate for an arbitrary organization, user or device, or to cause a denial of service (DoS) condition.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd
-
Cisco investigated its product line to determine which products and services may be affected by this vulnerability.
The Vulnerable Products section includes Cisco bug IDs for each product. The bugs will be accessible through the Cisco Bug Search Tool and will contain additional platform-specific information, including workarounds (if available) and fixed software releases.
Any product or service not listed in the Vulnerable Products section of this advisory is to be considered not vulnerable.
Vulnerable Products
The following table lists Cisco products that are affected by the vulnerabilities that are described in this advisory. If a future release date is indicated for software, the date provided represents an estimate based on all information known to Cisco as of the Last Updated date at the top of the advisory. Availability dates are subject to change based on a number of factors, including satisfactory testing results and delivery of other priority features and fixes. If no version or date is listed for an affected component (indicated by a blank field and/or an advisory designation of Interim), customers should refer to the associated Cisco bug(s) for further details. After the advisory is marked Final, customers should refer to the associated Cisco bug(s) for further details.
Product Cisco Bug ID Fixed Release Availability Collaboration and Social Media Cisco Webex Meetings Server CSCvx82619 4.0MR4 (May 2021) Endpoint Clients and Client Software Cisco Webex Meetings for iOS CSCvx82617 41.4 (Feb 2021)
11.4 (Feb 2021)Meraki Products Cisco Meraki MS390 - Release TBD (May 2021) Network and Content Security Devices Cisco Firepower 4100 Series CSCvx82705 2.10.1 (May 2021)
2.9.1 (Jun 2021)
2.11.1 (Oct 2021)Cisco Firepower 9300 Security Appliances CSCvx82705 2.10.1 (May 2021)
2.9.1 (Jun 2021)
2.11.1 (Oct 2021)Cisco Threat Grid Appliance M5 CSCvx82740 2.13.0 (Apr 2021) Cisco Web Security Appliance (WSA) CSCvx82614 14.0 (Jun 2021) Network Management and Provisioning Cisco Business Process Automation CSCvx82587 3.1 (Jun 2021) Cisco Connected Pharma CSCvx82681 1.5.7 (May 2021) Cisco Container Platform CSCvx82677 10.0.0 (Apr 2021) Cisco Evolved Programmable Network Manager CSCvx82652 5.1 (April 2021) Cisco Kinetic for Cities CSCvx82734 MD 3.5.2.15 (April 2021) Cisco Managed Services Accelerator CSCvx82693 4.0.0 (Jul 2021) Cisco Policy Suite CSCvx82748 21.2 (Aug 2021) Cisco Prime Infrastructure CSCvx82664 3.10 (Sept 2021)
3.9 (May 2021)Cisco Security Manager CSCvx82670 CSM 4.24 (Dec 2021) Cisco Virtualized Infrastructure Manager CSCvx82666 4.2 (May 2021)
4.2.1 (July 2021)Routing and Switching - Enterprise and Service Provider Cisco 800 Series Industrial Integrated Services Routers (IOx feature) CSCvx88577 15.9(3)M4 (Jul 2021) Cisco IOS XR Software CSCvx82673 7.3.2 (Oct 2021)
7.5.1 (Dec 2021)Cisco IOS and IOS XE Software CSCvx82754 17.6.1 (Jul 2021)
17.3.4 (Jun 2021)
17.4.3 (Dec 2021)Cisco IOx Fog Director CSCvx82750 1.14.3 (Apr 2021) Cisco Nexus 3000 Series Switches (NX-OS 10.1) CSCvx82861 10.1.2 (Apr 2021) Cisco Nexus 9000 Series Switches in standalone NX-OS mode (NX-OS 10.1) CSCvx82861 10.1.2 (Apr 2021) Cisco c800 Series Integrated Services Routers (IOx feature) CSCvx82752 15.9(3)M4 (Jul 2021) Routing and Switching - Small Business Cisco 250 Series Smart Switches CSCvx82728 3.2.x (Mar 2022) Cisco 350 Series Managed (SF350 and SG350) Switches CSCvx82727 3.2.x (Mar 2022) Cisco 550X Series Stackable (SF550 and SG550) Managed Switches CSCvx82727 3.2.x (Mar 2022) Cisco Business 250 Series Smart Switches CSCvx82710 3.2.x (Mar 2022) Cisco Business 350 Series Managed Switches CSCvx82710 3.2.x (Mar 2022) Cisco Small Business RV Series RV320 Dual Gigabit WAN VPN Router CSCvx82720 None planned Cisco Small Business RV Series RV325 Dual WAN VPN Router CSCvx82721 None planned Cisco Small Business RV130 Series VPN Routers CSCvx82717 None planned Unified Computing Cisco UCS B-Series Blade Servers CSCvx82644 4.2(1) (May 2021) Cisco UCS Standalone C-Series Rack Server - Integrated Management Controller CSCvx82648 4.2(1a) (May 2021) Voice and Unified Communications Devices Cisco Computer Telephony Integration Object Server (CTIOS) CSCvx82605 12.6(1) (May 2021)
12.5(1) (May 2021)Cisco IP Conference Phone 7832 with Multiplatform Firmware CSCvx84316 11.3.4 (Jun 2021) Cisco IP Conference Phone 7832 CSCvx82765 14.1.1 (Sept 2021) Cisco IP Conference Phone 8832 with Multiplatform Firmware CSCvx84321 11.3.4 (Jun 2021) Cisco IP Conference Phone 8832 CSCvx82791 14.1.1 (Sept 2021) Cisco IP Phone 6800 Series with Multiplatform Firmware CSCvx84326 11.3.4 (Jun 2021) Cisco IP Phone 7800 Series with Multiplatform Firmware CSCvx84320 11.3.4 (Jun 2021) Cisco IP Phone 8800 Series with Multiplatform Firmware CSCvx84314 11.3.4 (Jun 2021) Cisco IP Phone 8800 Series CSCvx84332 14.1.1 (Sept 2021) Cisco IP Phone 8845 with Multiplatform Firmware CSCvx84315 11.3.4 (Jun 2021) Cisco IP Phone 8845 CSCvx84323 14.1.1 (Sept 2021) Cisco IP Phone 8865 with Multiplatform Firmware CSCvx84315 11.3.4 (Jun 2021) Cisco IP Phone 8865 CSCvx84323 14.1.1 (Sept 2021) Cisco Unified Contact Center Enterprise CSCvx82605 12.6(1) (May 2021)
12.5(1) (May 2021)Cisco Unified Intelligent Contact Management Enterprise CSCvx82605 12.6(1) (May 2021)
12.5(1) (May 2021)Cisco Virtualization Experience Media Edition CSCvx82792 14.0.1 (May 2021) Cisco Webex Hybrid Data Security Node CSCvx82620 2021.02.10.4763 (May 2021) Cisco Webex Room Phone CSCvx84328 1.2(0)SR1 (Aug 2021) Cisco Webex Video Mesh CSCvx82684 2021.04.22.2nnn (Apr 2021) Cisco Webex Wireless Phone CSCvx84322 1.3(0) (Jun 2021) Cisco Wireless IP Phone 8821 CSCvx82788 11.0(6)SR2 (Sept 2021) Video, Streaming, TelePresence, and Transcoding Devices Cisco Meeting Server CSCvx82685 3.2.1 (May 2021)
3.1.3 (May 2021)Cisco TelePresence MX and SX Series CSCvy03325 CE-10.3.2.x (May 2021)
CE-9.15.3.x (May 2021)Cisco Video Surveillance Media Server CSCvx82708 VSM-7.14.3 (May 2021) Cisco Webex Board (all models) CSCvy03325 CE-10.3.2.x (May 2021)
CE-9.15.3.x (May 2021)Cisco Webex DX70 and DX80 CSCvy03325 CE-10.3.2.x (May 2021)
CE-9.15.3.x (May 2021)Wireless Cisco WAP121 Wireless-N Access Point with Single Point Setup CSCvx82732 None planned Cisco WAP321 Wireless-N Access Point with Single Point Setup CSCvx82732 None planned Cisco WAP371 Wireless-AC/N Access Point with Single Point Setup CSCvx82730 None planned Cisco Cloud Hosted Services Cisco Cloud Network Automation Provisioner CSCvx82591 Cisco Smart Net Total Care - On-Premises CSCvx82599 2.1.1 (May 2021) Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory are known to be affected by these vulnerabilities.
Cisco has confirmed that these vulnerabilities do not affect the following products:
Endpoint Clients and Client Software
- Cisco AnyConnect - Network Access Manager
- Cisco AnyConnect Secure Mobility Client for Android
- Cisco AnyConnect Secure Mobility Client for Linux
- Cisco AnyConnect Secure Mobility Client for Mac OS X
- Cisco AnyConnect Secure Mobility Client for Windows
- Cisco AnyConnect Secure Mobility Client for iOS
- Cisco Jabber Guest
- Cisco Jabber Software Development Kit
- Cisco Jabber for Mac
- Cisco Jabber for Windows
- Cisco Webex Business Suite
- Cisco Webex Meetings Client - Hosted
Meraki Products
- Cisco Meraki Go (all models)
- Cisco Meraki MG (all models)
- Cisco Meraki MR (all models)
- Cisco Meraki MS120 Series
- Cisco Meraki MS125 Series
- Cisco Meraki MS210 Series
- Cisco Meraki MS225 Series
- Cisco Meraki MS250 Series
- Cisco Meraki MS350 Series
- Cisco Meraki MS355 Series
- Cisco Meraki MS410 Series
- Cisco Meraki MS425 Series
- Cisco Meraki MS450 Series
- Cisco Meraki MT (all models)
- Cisco Meraki MV (all models)
- Cisco Meraki MX (all models)
- Cisco Meraki Z-Series (all models)
Network Application, Service, and Acceleration
- Cisco Cloud Services Platform 2100
- Cisco Tetration Analytics
- Cisco Wide Area Application Services (WAAS)
Network and Content Security Devices
- Cisco AMP Virtual Private Cloud Appliance
- Cisco Adaptive Security Appliance (ASA)
- Cisco Content Security Management Appliance (SMA)
- Cisco Email Security Appliance (ESA)
- Cisco Firepower 1000 Series
- Cisco Firepower 2100 Series
- Cisco Firepower Management Center
- Cisco Identity Services Engine (ISE)
- Cisco Umbrella Virtual Appliance
Network Management and Provisioning
- Cisco ACI Multi-Site Orchestrator
- Cisco Application Policy Infrastructure Controller (APIC)
- Cisco Cyber Vision
- Cisco Data Center Network Manager (DCNM)
- Cisco FindIT Network Probe
- Cisco NetFlow Generation Appliance
- Cisco Network Analysis Module
- Cisco Network Services Orchestrator (NSO)
- Cisco Prime Access Registrar
- Cisco Prime Collaboration Assurance
- Cisco Prime Collaboration Deployment
- Cisco Prime Collaboration Provisioning
- Cisco Prime License Manager
- Cisco Prime Network Change and Configuration Management
- Cisco Prime Network Registrar Virtual Appliance
- Cisco Prime Network Registrar
- Cisco Prime Optical for Service Providers
- Cisco Prime Performance Manager
- Cisco Prime Service Catalog Virtual Appliance
- Cisco Telemetry Broker
- Cisco UCS Central Software
- Cisco WAN Automation Engine (WAE)
Routing and Switching - Enterprise and Service Provider
- Cisco ACI Virtual Edge
- Cisco ASR 5000 Series Routers
- Cisco ASR 9000 Series Aggregated Services Router Virtualized Services Module
- Cisco Application Policy Infrastructure Controller (APIC) - Enterprise Module
- Cisco DNA Center
- Cisco MDS 9000 Series Multilayer Switches
- Cisco Network Assurance Engine
- Cisco Nexus 1000V Series Switches
- Cisco Nexus 5500 Platform Switches
- Cisco Nexus 5600 Platform Switches
- Cisco Nexus 6000 Series Switches
- Cisco Nexus 7000 Series Switches
- Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode
- Cisco SD-WAN vEdge 1000 Series Routers
- Cisco SD-WAN vEdge 2000 Series Routers
- Cisco SD-WAN vEdge 5000 Series Routers
- Cisco SD-WAN vEdge Cloud Router Platform
- Cisco Stealthwatch Cloud
- Cisco Stealthwatch Endpoint Concentrator
- Cisco Stealthwatch Flow Collector NetFlow
- Cisco Stealthwatch Flow Collector sFlow
- Cisco Stealthwatch Flow Sensor
- Cisco Stealthwatch Management Console (SMC)
- Cisco Stealthwatch UDP Director
Routing and Switching - Small Business
- Cisco 220 Series Smart Plus (SF220 and SG220) Switches
- Cisco 500 Series Stackable (SF500 and SG500) Managed Switches
- Cisco FindIT Network Manager
- Cisco RV132W ADSL2+ Wireless-N VPN Router
- Cisco RV134W VDSL2 Wireless-AC VPN Router
- Cisco RV160 VPN Router
- Cisco RV160W Wireless-AC VPN Router
- Cisco RV260, RV260P, and RV260W VPN Routers
- Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router
- Cisco Small Business 300 Series (SF300 and SG300)
- Cisco WAP125 Wireless-AC Dual Band Desktop Access Point with PoE
- Cisco WAP150 Wireless-AC/N Dual Radio Access Point with PoE
- Cisco WAP361 Wireless-AC/N Dual Radio Wall Plate Access Point with PoE
- Cisco WAP571 Wireless-AC/N Premium Dual Radio Access Point with PoE
- Cisco WAP571E Wireless-AC/N Premium Dual Radio Outdoor Access Point
- Cisco WRP500 Wireless-AC Broadband Router
Unified Computing
- Cisco Common Services Platform Collector
- Cisco Enterprise NFV Infrastructure Software (NFVIS)
- Cisco HyperFlex System
- Cisco UCS 6200 Series Fabric Interconnects
- Cisco UCS 6300 Series Fabric Interconnects
- Cisco UCS 6400 Series Fabric Interconnects
- Cisco UCS Director
- Cisco UCS E-Series Servers
- Cisco UCS Manager
Voice and Unified Communications Devices
- Cisco ATA 191 Analog Telephone Adapter
- Cisco Agent Desktop for Cisco Unified Contact Center Express
- Cisco Business Edition 4000
- Cisco Emergency Responder
- Cisco Finesse
- Cisco Hosted Collaboration Mediation Fulfillment
- Cisco IP DECT 110 Repeater with Multiplatform Firmware
- Cisco IP DECT 210 Multi-Cell Base-Station
- Cisco IP DECT 6800 Series
- Cisco IP DECT 6823 with Multiplatform Firmware
- Cisco IP DECT Phone RPT-110 Repeater
- Cisco IP Phone 7800 Series
- Cisco MediaSense
- Cisco Paging Server (InformaCast)
- Cisco Paging Server
- Cisco SPA51x IP Phones
- Cisco SPA8800 IP Telephony Gateway
- Cisco Small Business SPA300 Series IP Phones
- Cisco Small Business SPA500 Series IP Phones
- Cisco Unified Attendant Console Advanced
- Cisco Unified Attendant Console Business Edition
- Cisco Unified Attendant Console Department Edition
- Cisco Unified Attendant Console Enterprise Edition
- Cisco Unified Attendant Console Premium Edition
- Cisco Unified Attendant Console Standard
- Cisco Unified Communications Domain Manager
- Cisco Unified Communications Manager / Cisco Unified Communications Manager Session Management Edition
- Cisco Unified Communications Manager IM &Presence Service (formerly CUPS)
- Cisco Unified Contact Center Express
- Cisco Unified IP Conference Phone 8831
- Cisco Unified IP Phone 3905
- Cisco Unified IP Phone 6901
- Cisco Unified IP Phone 6911
- Cisco Unified IP Phone 7937
- Cisco Unified IP Phone 8945
- Cisco Unified IP Phone 8965
- Cisco Unified Intelligence Center
- Cisco Unified SIP Proxy Software
- Cisco Unity Connection
- Cisco Unity Express
- Cisco Virtualized Voice Browser
- Cisco Webex Share
Video, Streaming, TelePresence, and Transcoding Devices
- Cisco Expressway Series
- Cisco Meeting Management
- Cisco TelePresence Video Communication Server (VCS)
- Cisco Video Surveillance 8000 Series IP Cameras
Wireless
- Cisco ASA 5506W-X with FirePOWER Services
- Cisco Aironet 1560 Series Access Points
- Cisco Aironet 1810 Series OfficeExtend Access Points
- Cisco Aironet 1810w Series Access Points
- Cisco Aironet 1815 Series Access Points
- Cisco Aironet 1830 Series Access Points
- Cisco Aironet 1850 Series Access Points
- Cisco Aironet 2800 Series Access Points
- Cisco Aironet 3800 Series Access Points
- Cisco Aironet 4800 Access Points
- Cisco Aironet Access Points - Running Cisco IOS Software
- Cisco Catalyst 9100 Access Points
- Cisco Wireless LAN Controller
Cisco Cloud Hosted Services
- Cisco Business Video Services Automation Software
- Cisco CX Cloud Agent Software
- Cisco Cloud Email Security
- Cisco Cloud Web Security
- Cisco Registered Envelope Service
- Cisco Services Provisioning Platform
- Cisco Unified Communications Manager Cloud
- Cisco Universal Small Cell CloudBase Factory Recovery Root File System - Releases 2.99.4 and later
- Cisco Webex Centers - Meeting Center, Training Center, Event Center, Support Center
- Cisco Webex Meeting Server - Multimedia Platform
- Cisco Webex Network-Based Recording (NBR) Management
-
OpenSSL Certificate Validation Vulnerability
OpenSSL contains a vulnerability that could allow an attacker to use a valid non-certificate authority (CA) certificate to act as a CA and sign a certificate for an arbitrary organization, user, or device.
The vulnerability is due to a bypassed check in the validation logic of X.509 certificate chains, resulting in the affected system accepting as valid certificates signed by a non-CA certificate or certificate chain. An attacker can exploit this vulnerability by using any valid certificate or certificate chain to sign a crafted certificate. A successful exploit could allow the attacker to conduct a main-in-the-middle (MiTM) attack and obtain sensitive information (or misreport information) or impersonate an organization, user, or device. Exploitation of this vulnerability could also allow attackers to access networks or assets that are protected by certificate authentication.
This vulnerability has been assigned the following CVE ID:
- CVE-2021-3450
OpenSSL NULL Pointer Dereference Denial of Service Vulnerability
OpenSSL contains a vulnerability that could allow an attacker to cause a denial of service (DoS) condition on a targeted system.
The vulnerability exists because the affected software incorrectly handles memory structures, leading to a NULL pointer dereference. An attacker could exploit the vulnerability by submitting crafted Transport Layer Security (TLS) packets to an interface of an affected device. A successful exploit could allow the attacker to cause a crash of the TLS server process which could result in a DoS condition on the targeted device.
Note: Only servers that are processing incoming TLSv1.2 packets are affected by this vulnerability.
This vulnerability has been assigned the following CVE ID:
- CVE-2021-3449
-
Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products section of this advisory.
-
For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products section of this advisory.
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
-
On March 25, 2021, the OpenSSL Project released OpenSSL Security Advisory [25 March 2021] detailing these vulnerabilities.
The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerability that is described in this advisory and identified by CVE-2021-3449. Cisco PSIRT is not aware of any malicious use of this vulnerability (CVE-2021-3449).
Cisco PSIRT is not aware of exploit code for or any malicious use of the vulnerability identified by CVE-2021-3450.
-
These vulnerabilities were publicly disclosed by the OpenSSL Software Foundation on March 25, 2021.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Show LessVersion Description Section Status Date 1.20 Updated the fixed release availability information for Cisco IOS and IOS XE Software. Removed a duplicate entry for Webex Room Phone. Vulnerable Products Final 2021-SEP-10 1.19 Updated Webex Room Phone fixed release. Vulnerable Products Final 2021-AUG-30 1.18 Updated the advisory throughout to reflect that the investigation is complete. The fix availability information and the lists of vulnerable and not vulnerable products did not change. Header, Summary, Affected Products, and Vulnerable Products Final 2021-JUL-06 1.17 Removed the Cisco bug IDs from the advisory header. Header Interim 2021-MAY-10 1.16 Updated the lists of products vulnerable, and not vulnerable. Note that upon further investigation Cisco has confirmed that Cisco Meraki MS390 is affected by the vulnerability identified by the CVE ID CVE-2021-3449. It was incorrectly listed as not vulnerable in a previous version of the advisory. Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable Interim 2021-MAY-07 1.15 Updated the lists of vulnerable products and products confirmed not vulnerable. Upon further investigation, Cisco has confirmed that Cisco SD-WAN vEdge 1000, 2000, and 5000 Series Routers and Cisco SD-WAN vEdge Cloud Router Platform are not affected by these vulnerabilities. Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable Interim 2021-APR-27 1.14 Updated the lists of products vulnerable, and not vulnerable. Note that upon further investigation, Cisco has confirmed that Cisco FindIT Network Probe is not affected by these vulnerabilities. Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable Interim 2021-APR-22 1.13 Updated the list of vulnerable products. Removed the Cisco Bug ID CSCvx82788 and the CVSS score from the advisory header. Header and Vulnerable Products Interim 2021-APR-21 1.12 Updated the lists of products under investigation, vulnerable, and not vulnerable. Note that upon further investigation, Cisco has confirmed that Cisco Network Services Orchestrator (NSO) is not affected by these vulnerabilities. Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable Interim 2021-APR-20 1.11 Updated the lists of products under investigation, vulnerable, and not vulnerable. Updated fixed release availability for Cisco IOS XR Software, Cisco Firepower 4100 Series, Cisco Firepower 9300 Security Appliances. Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable Interim 2021-APR-15 1.10 Updated the lists of products under investigation, vulnerable, and not vulnerable. Note that upon further investigation Cisco has confirmed that Cisco Application Policy Infrastructure Controller (APIC) - Enterprise Module is not affected by these vulnerabilities. Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable Interim 2021-APR-14 1.9 Updated the lists of products under investigation, vulnerable, and not vulnerable. Update fixed release availability information for Cisco Computer Telephony Integration Object Server (CTIOS), Cisco Unified Contact Center Enterprise, and Cisco Unified Intelligent Contact Management Enterprise. Note that upon further investigation Cisco has confirmed that Cisco Webex Share, Cisco DNA Center, Cisco Jabber for Mac, Cisco Jabber for Windows, and Cisco Cyber Vision are not affected by these vulnerabilities. Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable Interim 2021-APR-12 1.8 Updated the lists of products under investigation, vulnerable, and not vulnerable. Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable Interim 2021-APR-08 1.7 Updated the lists of products under investigation, vulnerable, and not vulnerable. Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable Interim 2021-APR-06 1.6 Updated the lists of products under investigation, vulnerable, and not vulnerable. Updated the Revision History for version 1.3. Affected Products, Vulnerable Products, Products Confirmed Not Vulnerable, and Revision History Interim 2021-APR-05 1.5 Updated the lists of products under investigation, vulnerable, and not vulnerable. Included information about publicly available code to exploit the vulnerability identified by CVE-2021-3449. Note that upon further investigation Cisco has confirmed that Cisco Identity Services Engine (ISE) is not affected by these vulnerabilities. It was incorrectly listed as vulnerable in a previous version of the advisory. Affected Products, Vulnerable Products, Products Confirmed Not Vulnerable, and Exploitation and Public Announcements Interim 2021-APR-01 1.4 Updated the lists of products under investigation, vulnerable, and not vulnerable. Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable Interim 2021-MAR-31 1.3 Updated the lists of products under investigation, vulnerable, and not vulnerable. Changed "missing check" to "bypassed check" in Details. Note that upon further investigation Cisco has confirmed that Cisco Meeting Management is not affected by these vulnerabilities. It was incorrectly listed as vulnerable in a previous version of the advisory. Affected Products, Vulnerable Products, Products Confirmed Not Vulnerable, and Details Interim 2021-MAR-30 1.2 Updated the lists of products under investigation, vulnerable, and not vulnerable. Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable Interim 2021-MAR-29 1.1 Updated the lists of products under investigation. Vulnerable Products Interim 2021-MAR-26 1.0 Initial public release. - Interim 2021-MAR-25
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.