TI-2021-00970 Aliases CVE-2021-1243 GHSA-w6r6-frp2-8r52

Cisco IOS XR Software SNMP Management Plane Protection ACL Bypass Vulnerability

MEDIUM 41CWE-284Published 2021-02-04 · Updated 2024-11-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

A vulnerability in the Local Packet Transport Services (LPTS) programming of the SNMP with the management plane protection feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to allow connections despite the management plane protection that is configured to deny access to the SNMP server of an affected device. This vulnerability is due to incorrect LPTS programming when using SNMP with management plane protection. An attacker could exploit this vulnerability by connecting to an affected device using SNMP. A successful exploit could allow the attacker to connect to the device on the configured SNMP ports. Valid credentials are required to execute any of the SNMP requests.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01289 70th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco IOS XR Software	all versions	—	No fix listed	CNA

Cisco IOS XR Software VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:o:cisco:ios_xr::::::::	after 6.1.1, before 6.6.4; 7.0.0 to before 7.0.2	Vulnerable	Cisco
cpe:2.3:o:cisco:ios_xr:6.7.1:::::::*	6.7.1	Vulnerable	Cisco
cpe:2.3:o:cisco:ios_xr:7.0.11:::::::*	7.0.11	Vulnerable	Cisco
cpe:2.3:o:cisco:ios_xr:7.1.0:::::::*	7.1.0	Vulnerable	Cisco
cpe:2.3:o:cisco:ios_xr:7.2.0:::::::*	7.2.0	Vulnerable	Cisco

cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:* Versions after 6.1.1, before 6.6.4; 7.0.0 to before 7.0.2 Vulnerable ·Cisco
cpe:2.3:o:cisco:ios_xr:6.7.1:*:*:*:*:*:*:* Versions 6.7.1 Vulnerable ·Cisco
cpe:2.3:o:cisco:ios_xr:7.0.11:*:*:*:*:*:*:* Versions 7.0.11 Vulnerable ·Cisco
cpe:2.3:o:cisco:ios_xr:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Cisco
cpe:2.3:o:cisco:ios_xr:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-1243
2026-10-03 Alias added: GHSA-w6r6-frp2-8r52

References

Advisory 1

20210203 Cisco IOS XR Software SNMP Management Plane Protection ACL Bypass Vulnerability

TI-2020-02680 Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability KEVCVSS 3.1HIGH 8.8
TI-2018-00135 Memory corruption in Cisco IOS, IOS XE, and IOS XR KEVCVSS 3.1HIGH 8.8
TI-2020-03113 Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities KEVCVSS 3.1HIGH 8.6
TI-2020-03110 Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability KEVCVSS 3.1HIGH 8.6
TI-2018-00142 Memory corruption in Cisco IOS, IOS XE, and IOS XR KEVCVSS 3.1HIGH 8.0
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5

See all 199 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences