VDB

CVE-2021-34705

CVE-2021-34705 PUBLISHED CVSS 5.300000190734863 MEDIUM

A vulnerability in the Voice Telephony Service Provider (VTSP) service of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured destination patterns and dial arbitrary numbers. This vulnerability is due to insufficient validation of dial strings at Foreign Exchange Office (FXO) interfaces. An attacker could exploit this vulnerability by sending a malformed dial string to an affected device via either the ISDN protocol or SIP. A successful exploit could allow the attacker to conduct toll fraud, resulting in unexpected financial impact to affected customers.

EPSS 0.55% · 68.4th percentile

Risk Scores

CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score
0.55%
68.4th percentile

Affected Products

VendorProductVersions
ciscoios*, *, *
ciscoios_xe3.7.0s, 3.7.1s, 3.7.2s
CiscoCisco IOSn/a

Exploit Intelligence

Timeline

  • Apr 13, 2021 CVE Published
  • Sep 23, 2021 EPSS Score
  • Nov 19, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Jan 15, 2022 EPSS Score
  • Mar 14, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 10, 2022 EPSS Score
  • Jul 6, 2022 EPSS Score
  • Sep 2, 2022 EPSS Score
  • Oct 29, 2022 EPSS Score
  • Dec 26, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›