CVE-2021-1624
Assigner: cisco
Published: 2021-09-22T00:00:00
State: PUBLISHED
affected: product: Cisco IOS XE Software 
vendor: Cisco
versions: status: affected
version: n/a
datePublic: 2021-09-22T00:00:00
descriptions: value: A vulnerability in the Rate Limiting Network Address Translation (NAT) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause high CPU utilization in the Cisco QuantumFlow Processor of an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to mishandling of the rate limiting feature within the QuantumFlow Processor. An attacker could exploit this vulnerability by sending large amounts of traffic that would be subject to NAT and rate limiting through an affected device. A successful exploit could allow the attacker to cause the QuantumFlow Processor utilization to reach 100 percent on the affected device, resulting in a DoS condition.
exploits: value: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. 
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-399
description: CWE-399
type: CWE
source: advisory: cisco-sa-ratenat-pYVLA7wM
defect: CSCvx37176
discovery: INTERNAL
title: Cisco IOS XE Software Rate Limiting Network Address Translation Denial of Service Vulnerability