High severity · published Oct 6, 2021
CVE-2021-34780
Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches. An unauthenticated, adjacent attacker could perform the following: Execute code on the affected device or cause it to reload unexpectedly Cause LLDP database corruption on the affected device For more information about these vulnerabilities, see the Details section of this advisory. Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). Cisco has released firmware updates that address these vulnerabilities.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
B2
Business 220-16p-2g Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-16t-2g Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-24fp-4g Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-24fp-4x Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-24p-4g Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-24p-4x Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-24t-4g Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-24t-4x Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-48fp-4x Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-48p-4g Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-48p-4x Firmware · Cisco
through 1.2.0.6 · source: NVD
B2
Business 220-48t-4g Firmware · Cisco
through 1.2.0.6 · source: NVD
Affected product
B2
Business 220-16p-2g Firmware
Cisco
More from Business 220-16p-2g Firmware
8.8
CVE-2021-34779
Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches
5.5
CVE-2021-34757
Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or…
4.9
CVE-2021-34744
Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or…
4.3
CVE-2021-34778
Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches
4.3
CVE-2021-34777
Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches