CVE-2021-34787
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco ASA and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass security protections. This is due to improper handling of network requests by devices configured with object group search. An attacker could send a specially crafted request to bypass ACL rules and send traffic to unauthorized hosts.
Risk Assessment
The risk is the potential to bypass network security controls and access unauthorized systems, potentially leading to data confidentiality and integrity breaches.
Recommendation
It is recommended to update Cisco ASA/FTD software to a patched version and monitor vendor advisories for necessary updates.
Original NVD description (English source)
A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass security protections. This vulnerability is due to improper handling of network requests by affected devices configured to use object group search. An attacker could exploit this vulnerability by sending a specially crafted network request to an affected device. A successful exploit could allow the attacker to bypass access control list (ACL) rules on the device, bypass security protections, and send network traffic to unauthorized hosts.