Vulnerabilities > CVE-2021-1403 - Improper Restriction of Rendered UI Layers or Frames vulnerability in Cisco IOS XE

CVSS 7.4 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

cisco

CWE-1021

NVD

Published: 2021-03-24

Updated: 2023-11-07

Summary

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site WebSocket hijacking (CSWSH) attack and cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient HTTP protections in the web UI on an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the web UI to follow a crafted link. A successful exploit could allow the attacker to corrupt memory on the affected device, forcing it to reload and causing a DoS condition.

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco IOS XE 16.6.1 Cisco IOS XE 16.4.1 Cisco IOS XE 16.3.1 Cisco IOS XE 16.3.1A Cisco IOS XE 16.3.2 Cisco IOS XE 16.3.3 Cisco IOS XE 16.5.1 Cisco IOS XE 16.5.1A Cisco IOS XE 16.3.4 Cisco IOS XE 16.5.1B Cisco IOS XE 16.4.2 Cisco IOS XE 16.3.5B Cisco IOS XE 16.3.6 Cisco IOS XE 16.6.3 Cisco IOS XE 16.8.1 Cisco IOS XE 16.7.1 Cisco IOS XE 16.6.2 Cisco IOS XE 16.9.1 Cisco IOS XE 16.3.5 Cisco IOS XE 16.5.2 Cisco IOS XE 16.8.1A Cisco IOS XE 16.8.1S Cisco IOS XE 16.8.1B Cisco IOS XE 16.8.2 Cisco IOS XE 16.7.2 Cisco IOS XE 16.8.1D Cisco IOS XE 16.7.3 Cisco IOS XE 16.7.1A Cisco IOS XE 16.7.1B Cisco IOS XE 16.8.1C Cisco IOS XE 16.8.1E Cisco IOS XE 16.4.3 Cisco IOS XE 16.9.1S Cisco IOS XE 16.9.1C Cisco IOS XE 16.9.1B Cisco IOS XE 16.5.3 Cisco IOS XE 16.3.7 Cisco IOS XE 16.3.8 Cisco IOS XE 16.9.1D Cisco IOS XE 16.6.4S Cisco IOS XE 16.6.4 Cisco IOS XE 16.10.1 Cisco IOS XE 16.7.4 Cisco IOS XE 16.9.1A Cisco IOS XE 16.9.2A Cisco IOS XE 16.9.2 Cisco IOS XE 16.6.4A Cisco IOS XE 16.12.1 Cisco IOS XE 16.6.5 Cisco IOS XE 16.11.1 Cisco IOS XE 17.1.1 Cisco IOS XE 16.11.1A Cisco IOS XE 16.12.1C Cisco IOS XE 16.12.1T Cisco IOS XE 16.11.2 Cisco IOS XE 16.12.1S Cisco IOS XE 16.12.1A Cisco IOS XE 16.12.1X Cisco IOS XE 16.11.1C Cisco IOS XE 16.11.1B Cisco IOS XE 16.11.1S Cisco IOS XE 16.12.1W Cisco IOS XE 16.10.1S Cisco IOS XE 16.10.1D Cisco IOS XE 16.9.2S Cisco IOS XE 16.6.6 Cisco IOS XE 16.9.3H Cisco IOS XE 16.6.5B Cisco IOS XE 16.6.5A Cisco IOS XE 16.3.9 Cisco IOS XE 16.9.3A Cisco IOS XE 16.10.1A Cisco IOS XE 16.10.1F Cisco IOS XE 16.10.1G Cisco IOS XE 16.10.2 Cisco IOS XE 16.9.3 Cisco IOS XE 16.12.1Y Cisco IOS XE 16.10.1E Cisco IOS XE 16.10.1B Cisco IOS XE 16.8.3 Cisco IOS XE 16.9.3S Cisco IOS XE 16.10.1C Cisco IOS XE 16.9.4 Cisco IOS XE 16.12.2 Cisco IOS XE 16.6.7A Cisco IOS XE 16.9.4C Cisco IOS XE 16.12.2A Cisco IOS XE 16.6.7 Cisco IOS XE 16.10.3 Cisco IOS XE 16.12.4 Cisco IOS XE 16.3.10 Cisco IOS XE 16.9.5 Cisco IOS XE 16.9.5F Cisco IOS XE 16.6.8 Cisco IOS XE 16.12.3 Cisco IOS XE 17.2.1 Cisco IOS XE 17.1.1S Cisco IOS XE 16.12.2T Cisco IOS XE 17.1.1A Cisco IOS XE 16.12.2S Cisco IOS XE 16.12.3A Cisco IOS XE 17.1.1T Cisco IOS XE 16.3.11 Cisco IOS XE 17.2.1A Cisco IOS XE 3.15.2Xbs Cisco IOS XE 17.2.1V Cisco IOS XE 16.12.1Z Cisco IOS XE 16.12.3S Cisco IOS XE 3.15.1Xbs Cisco IOS XE 17.2.1R Cisco IOS XE 17.1.2 Cisco IOS XE 16.12.4A Cisco IOS XE 17.1.3 Cisco IOS XE 17.2.2 Cisco IOS XE 17.3.1 Cisco IOS XE 16.12.1Za Cisco IOS XE 17.3.2 Cisco IOS XE 17.3.1A Cisco IOS XE 17.3.2A Cisco IOS XE 17.3.1W Cisco IOS XE 17.2.3 Cisco IOS XE 16.9.6 Cisco IOS XE 17.3.1X	123

Common Weakness Enumeration (CWE)

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-cswsh-FKk9AzT5