CVE-2021-34714

Q: What is the severity of CVE-2021-34714?

CVE-2021-34714 has a CVSS score of 7.4 (HIGH). This vulnerability allows an unauthenticated attacker on the same network segment to send specially crafted UDLD packets to Cisco networking devices, causing them to reload and creating a denial of service. It affects multiple Cisco operating systems including IOS, IOS XE, IOS XR, and NX-OS. The UDLD feature is disabled by default, limiting exposure.

7.4 HIGH

Denial of Service

📋 TL;DR

This vulnerability allows an unauthenticated attacker on the same network segment to send specially crafted UDLD packets to Cisco networking devices, causing them to reload and creating a denial of service. It affects multiple Cisco operating systems including IOS, IOS XE, IOS XR, and NX-OS. The UDLD feature is disabled by default, limiting exposure.

💻 Affected Systems

Products:

Cisco FXOS Software
Cisco IOS Software
Cisco IOS XE Software
Cisco IOS XR Software
Cisco NX-OS Software

Versions: Multiple versions across affected products - check Cisco advisory for specifics

Operating Systems: Cisco FXOS, Cisco IOS, Cisco IOS XE, Cisco IOS XR, Cisco NX-OS

Default Config Vulnerable: ✅ No

Notes: UDLD feature must be enabled for vulnerability to be exploitable. UDLD is disabled by default on most platforms.

📦 What is this software?

Ios Xe by Cisco

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device reload causing extended network downtime and service disruption

🟠

Likely Case

Temporary DoS until device reboots, with potential for repeated attacks

🟢

If Mitigated

No impact if UDLD is disabled or proper network segmentation is in place

🌐 Internet-Facing: LOW - Requires adjacent network access, not remote exploitation

🏢 Internal Only: MEDIUM - Internal attackers with network access could disrupt critical infrastructure

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires adjacent network access and control of a directly connected device. Attack conditions are strict according to Cisco.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Varies by product - refer to Cisco advisory for specific fixed versions

Vendor Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-nxos-xr-udld-dos-W5hGHgtQ

Restart Required: Yes

Instructions:

1. Check Cisco advisory for affected versions. 2. Upgrade to recommended fixed version. 3. Reboot device after upgrade. 4. Verify UDLD configuration if needed.

🔧 Temporary Workarounds

Disable UDLD feature

all

Disable the UDLD feature globally or on specific interfaces

no udld enable
interface <interface>
no udld enable

Network segmentation

all

Implement strict network segmentation to limit adjacent access

🧯 If You Can't Patch

Disable UDLD feature globally or on all interfaces
Implement strict access controls and network segmentation to limit adjacent attacker access

🔍 How to Verify

Check if Vulnerable:

Check if UDLD is enabled: 'show udld' or 'show running-config | include udld'

Check Version:

show version

Verify Fix Applied:

Verify running version matches fixed version from Cisco advisory and UDLD is disabled if not needed

📡 Detection & Monitoring

Log Indicators:

Device reload logs
UDLD process crashes
System instability messages

Network Indicators:

Unusual UDLD packet patterns
Repeated device reboots on network

SIEM Query:

Search for: 'device reload', 'UDLD error', 'system crash' in network device logs

📊 Metadata

CVE ID: CVE-2021-34714

CVSS v3 Score: 7.4 (HIGH)

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE: CWE-20

Published: September 23, 2021

Last Updated: November 21, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Firepower Extensible Operating System by Cisco

Firepower Extensible Operating System by Cisco

Firepower Extensible Operating System by Cisco

Firepower Extensible Operating System by Cisco

Firepower Extensible Operating System by Cisco

Fxos by Cisco

Fxos by Cisco

Fxos by Cisco

Fxos by Cisco

Fxos by Cisco

Fxos by Cisco

Fxos by Cisco

Ios by Cisco

Ios by Cisco

Ios by Cisco

Ios by Cisco

Ios by Cisco

Ios Xe by Cisco

Ios Xe by Cisco

Ios Xe by Cisco

Ios Xe by Cisco

Ios Xe by Cisco

Ios Xr by Cisco

Ios Xr by Cisco

Ios Xr by Cisco

Ios Xr by Cisco

Ios Xr by Cisco

Nx Os by Cisco

Nx Os by Cisco

Nx Os by Cisco

Nx Os by Cisco

Nx Os by Cisco

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable UDLD feature

Network segmentation

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities