CVE-2021-1373

8.6 HIGH

Denial of Service

📋 TL;DR

This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by sending a malformed CAPWAP packet to affected Cisco Catalyst 9000 Family Wireless Controllers running Cisco IOS XE Wireless Controller Software. It affects devices with insufficient validation of CAPWAP protocol packets, leading to crashes and reloads.

💻 Affected Systems

Products:

• Cisco Catalyst 9000 Family Wireless Controllers

Versions: Cisco IOS XE Wireless Controller Software versions prior to the fixed release; refer to Cisco advisory for specific ranges.

Operating Systems: Cisco IOS XE

Default Config Vulnerable: ⚠️ Yes

Notes: Affects devices using CAPWAP protocol; default configurations are vulnerable if running affected software versions.

📦 What is this software?

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

Ios Xe by Cisco

Cisco IOS XE is Cisco's modern network operating system running on enterprise routers, switches, and wireless controllers deployed across corporate networks, data centers, branch offices, and service provider infrastructure worldwide. As the evolution of Cisco IOS, IOS XE provides a Linux-based modu...

Learn more about Ios Xe →

⚠️ Risk & Real-World Impact

🔴

Worst Case

An attacker could repeatedly exploit this to cause sustained DoS, disrupting wireless network availability and potentially leading to operational downtime.

🟠

Likely Case

Most probable impact is intermittent DoS from targeted attacks, causing temporary service interruptions and requiring device reboots.

🟢

If Mitigated

With proper patching or workarounds, the risk is minimized to negligible, maintaining normal network operations.

🌐 Internet-Facing: HIGH, as the vulnerability is unauthenticated and remote, making internet-exposed devices prime targets for exploitation.

🏢 Internal Only: MEDIUM, as internal attackers could still exploit it, but network segmentation may reduce exposure compared to internet-facing systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation involves sending malformed CAPWAP packets, which is straightforward for attackers with network access to the target.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Refer to Cisco advisory for specific fixed versions (e.g., Cisco IOS XE releases as listed in the advisory).

Vendor Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-capwap-dos-2OA3JgKS

Restart Required: Yes

Instructions:

1. Check current software version. 2. Download and apply the patched version from Cisco. 3. Reboot the device to complete the update. 4. Verify the fix is applied.

🔧 Temporary Workarounds

Network Segmentation

all

Restrict access to CAPWAP ports (e.g., UDP 5246, 5247) to trusted sources only using ACLs or firewalls.

Copy

access-list 100 permit udp trusted-source any eq 5246
access-list 100 permit udp trusted-source any eq 5247
access-list 100 deny udp any any

🧯 If You Can't Patch

• Implement strict network access controls to limit CAPWAP traffic to authorized devices only.
• Monitor network traffic for anomalies and set up alerts for potential exploitation attempts.

🔍 How to Verify

Check if Vulnerable:

Copy

Check the device's software version against the affected versions listed in the Cisco advisory.

Check Version:

Copy

show version

Verify Fix Applied:

Copy

After patching, verify the software version matches the fixed release and test CAPWAP functionality.

📡 Detection & Monitoring

Log Indicators:

• Log entries indicating device crashes, reloads, or CAPWAP protocol errors.

Network Indicators:

• Unusual CAPWAP packet traffic from untrusted sources to affected ports.

SIEM Query:

Copy

Example: search for 'CAPWAP' AND ('crash' OR 'reload') in device logs.

📊 Metadata

CVE ID: CVE-2021-1373

CVSS v3 Score: 8.6 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE: CWE-126

Published: March 24, 2021

Last Updated: November 21, 2024

🔗 References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-capwap-dos-2OA3JgKS Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-capwap-dos-2OA3JgKS Vendor Advisory

📤 Share & Export

Twitter LinkedIn Reddit Copy Link

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-1373, you might also want to check these:

CVE-2017-17772 9.8

This vulnerability allows attackers to perform out-of-bounds reads in 802.11 frame processing functi...

Same vulnerability type (CWE-126)

CVE-2023-36397 9.8

This vulnerability allows remote attackers to execute arbitrary code on affected Windows systems by ...

Same vulnerability type (CWE-126)

CVE-2021-34584 9.1

CVE-2021-34584 is a buffer over-read vulnerability in the CODESYS V2 web server that allows attacker...

Same vulnerability type (CWE-126)