Skip to content
OpenAdvisories
High ICSA-21-110-02 7 CVEs

ICSA-21-110-02_Rockwell Automation Stratix Switches

Published Apr 20, 2021 · Updated Apr 20, 2021

Vendor: Rockwell Automation Product: Stratix 5400 Product: Stratix 5410 Product: Stratix 5700 Product: Stratix 5800 Product: Stratix 8000

Summary

Cisco reported these vulnerabilities to Rockwell Automation.

Vulnerabilities 7

  • High 7.8
    CVE-2021-1392

    Cisco IOS and IOS XE Software Common Industrial Protocol Privilege Escalation Vulnerability

    A vulnerability in the CLI command permissions of Cisco IOS and Cisco IOS XE Software could allow an authenticated, local attacker to retrieve the password for Common Industrial Protocol (CIP) and then remotely configure the device as an administrative user. …

    Cisco Cisco IOS iOS Network devices
  • High 7.4
    CVE-2021-1352

    Cisco IOS XE Software DECnet Phase IV/OSI Denial of Service Vulnerability

    A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient i…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 7.4
    CVE-2021-1403

    Cisco IOS XE Software Web UI Cross-Site WebSocket Hijacking Vulnerability

    A vulnerability in the web UI feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site WebSocket hijacking (CSWSH) attack and cause a denial of service (DoS) condition on an affected device. This vulnerability i…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 7.0
    CVE-2021-1442

    Cisco IOS XE Software Plug-and-Play Privilege Escalation Vulnerability

    A vulnerability in a diagnostic command for the Plug-and-Play (PnP) subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to the level of an Administrator user (level 15) on an affected device. The vulnerability…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.8
    CVE-2021-1452

    Cisco IOS XE ROM Monitor Software for Cisco Industrial Switches OS Command Injection Vulnerability

    A vulnerability in the ROM Monitor (ROMMON) of Cisco IOS XE Software for Cisco Catalyst IE3200, IE3300, and IE3400 Rugged Series Switches, Cisco Catalyst IE3400 Heavy Duty Series Switches, and Cisco Embedded Services 3300 Series Switches could allow an unauth…

    Cisco Cisco IOS XE ROMMON Software iOS Network devices
  • Medium 5.5
    CVE-2021-1443

    Cisco IOS XE Software Web UI OS Command Injection Vulnerability

    A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying operating system of an affected device. The vulnerability exists because the affected softwar…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 4.3
    CVE-2021-1220

    Cisco IOS XE Software Web UI Denial of Service Vulnerabilities

    Multiple vulnerabilities in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to cause the web UI software to become unresponsive and consume vty line instances, resulting in a denial of service (DoS) …

    Cisco Cisco IOS XE Software iOS Network devices

Revision history

  1. #1

    ICSA-21-110-02 Rockwell Automation Stratix Switches

References