CVE-2021-34795
04.11.2021, 16:15
Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory.Enginsight
| Vendor | Product | Version |
|---|---|---|
| cisco | catalyst_pon_switch_cgp-ont-1p_firmware | 𝑥 < 1.1.1.14 |
| cisco | catalyst_pon_switch_cgp-ont-4p_firmware | 𝑥 < 1.1.3.17 |
| cisco | catalyst_pon_switch_cgp-ont-4pvc_firmware | 𝑥 < 1.1.3.17 |
| cisco | catalyst_pon_switch_cgp-ont-4tvcw_firmware | 𝑥 < 1.1.3.17 |
| cisco | catalyst_pon_switch_cgp-ont-4pv_firmware | 𝑥 < 1.1.3.17 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-284 - Improper Access ControlThe software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-1188 - Insecure Default Initialization of ResourceThe software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.