Medium severity · published Oct 6, 2021
CVE-2021-34744
Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or…
4.9
CVSS
0.7%
EPSS
No
On KEV
Description
Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or reconfigure the passwords on the user account. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
B2
Business 220-16p-2g Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-16t-2g Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-24fp-4g Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-24fp-4x Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-24p-4g Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-24p-4x Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-24t-4g Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-24t-4x Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-48fp-4x Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-48p-4g Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-48p-4x Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-48t-4g Firmware · Cisco
through 1.2.0.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-34744
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-34744
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-hardcoded-cred-MJCEXvX
More from Business 220-16p-2g Firmware
8.8
CVE-2021-34780
Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches
8.8
CVE-2021-34779
Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches
5.5
CVE-2021-34757
Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or…
4.3
CVE-2021-34778
Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches
4.3
CVE-2021-34777
Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches