Cisco ASR 900 and ASR 920 Series Aggregation Services Routers Access Control List Bypass Vulnerability
Priority LOW 34CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
A vulnerability in the access control list (ACL) programming of Cisco ASR 900 and ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incorrect programming of hardware when an ACL is configured using a method other than the configuration CLI. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00999 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco IOS XE Software | all versions | — | No fix listed | CNA |
- Cisco IOS XE Software VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:* | up to 17.3.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asr_902:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_903:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_907:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-10sz-pd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-10sz-pd_r:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-12cz-a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-12cz-a_r:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-12cz-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-12cz-d_r:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:* Versions up to 17.3.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:asr_902:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_903:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_907:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-10sz-pd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-10sz-pd_r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-12cz-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-12cz-a_r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-12cz-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-12cz-d_r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:cisco:asr_920-12sz-im:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-12sz-im_r:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-24sz-im:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-24sz-im_r:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-24sz-m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-24sz-m_r:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-24tz-m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-24tz-m_r:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-4sz-a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-4sz-a_r:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-4sz-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920-4sz-d_r:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asr_920u-12sz-im:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:h:cisco:asr_920-12sz-im:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-12sz-im_r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-24sz-im:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-24sz-im_r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-24sz-m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-24sz-m_r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-24tz-m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-24tz-m_r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-4sz-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-4sz-a_r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-4sz-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920-4sz-d_r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asr_920u-12sz-im:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-34696
- 2026-10-03 Alias added: GHSA-28xr-x3rf-rhgr
References
More Cisco Ios Xe vulnerabilities
- TI-2023-06904 Cisco is providing an update for the ongoing investigation into observed exploitation of… KEVCVSS 3.1CRITICAL 10.0
- TI-2018-00122 Memory corruption in Cisco IOS and IOS XE KEVCVSS 3.1CRITICAL 9.8
- TI-2017-02977 Improper input validation in Cisco IOS and IOS XE Software KEVCVSS 3.1CRITICAL 9.8
- TI-2018-00135 Memory corruption in Cisco IOS, IOS XE, and IOS XR KEVCVSS 3.1HIGH 8.8
- TI-2017-04498 Memory corruption in Cisco IOS KEVCVSS 3.1HIGH 8.8
- TI-2017-04497 Memory corruption in Cisco IOS XE Software KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2021-34696 · CVE Program
- CVE-2021-34696 · NVD
- FIRST EPSS
- GHSA-28xr-x3rf-rhgr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences