TI-2021-09220 Aliases CVE-2021-27862 GHSA-4fhf-8ph3-pp6c

Authentication bypass by spoofing in IEEE 802.2

LOW 23CWE-130Published 2022-09-27 · Updated 2025-11-04

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-290.

Summary

Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (and optionally VLAN0 headers).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00688 52nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IEEE	802.2	802.2h-1997 – 802.2h-1997	—	No fix listed	CNA
IETF	draft-ietf-v6ops-ra-guard-08	08 – 08	—	No fix listed	CNA

802.2 VendorIEEE Affected 802.2h-1997 – 802.2h-1997 Fixed in — No fix listed CNA
draft-ietf-v6ops-ra-guard-08 VendorIETF Affected 08 – 08 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:ieee:ieee_802.2::::::::	up to 802.2h-1997	Vulnerable	IEEE
cpe:2.3:a:ietf:p802.1q::::::::	up to d1.0	Vulnerable	IETF

cpe:2.3:a:ieee:ieee_802.2:*:*:*:*:*:*:*:* Versions up to 802.2h-1997 Vulnerable ·IEEE
cpe:2.3:a:ietf:p802.1q:*:*:*:*:*:*:*:* Versions up to d1.0 Vulnerable ·IETF

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2021-27862
2026-10-03 Alias added: GHSA-4fhf-8ph3-pp6c

References

Advisory 2

Other 2

TI-2021-09219 L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengths CVSS 3.1MEDIUM 4.7
TI-2021-09212 L2 network filtering bypass using stacked VLAN0, LLC/SNAP headers, and Ethernet to Wifi frame translation CVSS 3.1MEDIUM 4.7
TI-2021-09211 L2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers CVSS 3.1MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences