CVE-2021-34705

Cisco IOS and IOS XE Software FXO Interface Destination Pattern Bypass Vulnerability

Published Sep 23, 2021 CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed
Description
A vulnerability in the Voice Telephony Service Provider (VTSP) service of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured destination patterns and dial arbitrary numbers. This vulnerability is due to insufficient validation of dial strings at Foreign Exchange Office (FXO) interfaces. An attacker could exploit this vulnerability by sending a malformed dial string to an affected device via either the ISDN protocol or SIP. A successful exploit could allow the attacker to conduct toll fraud, resulting in unexpected financial impact to affected customers.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2021-21355 A vulnerability in the Voice Telephony Service Provider (VTSP) service of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured destination patterns and dial arbitrary numbers. This vulnerability is due to insufficient validation of dial strings at Foreign Exchange Office (FXO) interfaces. An attacker could exploit this vulnerability by sending a malformed dial string to an affected device via either the ISDN protocol or SIP. A successful exploit could allow the attacker to conduct toll fraud, resulting in unexpected financial impact to affected customers.
History
Type Values Removed Values Added
CPEs cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:ios_xe:-:*:*:*:*:*:*:*
Weaknesses

Sources

Status
PUBLISHED
Assigner
cisco
Published
Updated
Sep 16, 2024, 6:33 PM
Reserved
Jun 15, 2021, 12:00 AM
Status
Analyzed
Published
Sep 23, 2021, 3:15 AM
Modified
Jun 17, 2026, 3:56 AM