Cisco IOS XR Software SNMP Management Plane Protection ACL Bypass Vulnerability
cisco-sa-snmp-7MKrW7Nq · Medium · Published · Updated
A vulnerability in the Local Packet Transport Services (LPTS) programming of the SNMP with the management plane protection feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to allow connections despite the management plane protection that is configured to deny access to the SNMP server of an affected device. This vulnerability is due to incorrect LPTS programming when using SNMP with management plane protection. An attacker could exploit this vulnerability by connecting to an affected device using SNMP. A successful exploit could allow the attacker to connect to the device on the configured SNMP ports. Valid credentials are required to execute any of the SNMP requests. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-7MKrW7Nq
Workarounds
A temporary workaround is to remove and reapply the SNMP management plane protection configuration. Doing this will ensure that SNMP is configured first and the LPTS entries are correctly programmed. However, if the SNMP process restarts, the vulnerable LPTS entry state would reappear.
Alternatively, apply an access control list (ACL) directly to the SNMP configuration.
If the device is configured for SNMPv2, administrators can apply an access control list (ACL) to the SNMP configuration, as shown in the following example:
RP/0/RSP1/CPU0:IOS-XR#conf t
RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 161 RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 162 RP/0/RSP1/CPU0:IOS-XR(config)#snmp-server community RO allow_snmp RP/0/RSP1/CPU0:IOS-XR(config)#commit RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR#
If the device is configured for SNMPv3, administrators can apply an access control list (ACL) to the SNMP configuration either at group level or at user level as shown in the following examples:
Administrators can apply an access control list (ACL) to the SNMP configuration at user level as shown in the following example:
RP/0/RSP1/CPU0:IOS-XR#conf t
RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 161 RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 162
RP/0/RSP1/CPU0:IOS-XR(config)#snmp-server user v3 {auth | noauth | priv}
[read view] [write view] [notify view] allow_snmp
RP/0/RSP1/CPU0:IOS-XR(config)#commit
RP/0/RSP1/CPU0:IOS-XR(config
Administrators can apply an access control list (ACL) to the SNMP configuration at group level as shown in the following example:
RP/0/RSP1/CPU0:IOS-XR#conf t
RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 161 RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 162
RP/0/RSP1/CPU0:IOS-XR(config)#snmp-server group v3 {auth | noauth | priv} [read view] [write view] [notify view] allow_snmp
RP/0/RSP1/CPU0:IOS-XR(config)#commit
RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR#
| CVEs | CVE-2021-1243 |
|---|---|
| Cisco Bug IDs | CSCvt93184 |
| CVSS Score | Base 5.3 Base 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X |
| Product Names From Source | Cisco IOS XR Software |
Related Products
| Product | CVE | Evidence |
|---|