CVE-2021-1625
A vulnerability in the Zone-Based Policy Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent the Zone-Based Policy Firewall from correctly classifying traffic. This vulnerability exists because ICMP and UDP responder-to-initiator flows are not inspected when the Zone-Based Policy Firewall has either Unified Threat Defense (UTD) or Application Quality of Experience (AppQoE) configured. An attacker could exploit this vulnerability by attempting to send UDP or ICMP flows through the network. A successful exploit could allow the attacker to inject traffic through the Zone-Based Policy Firewall, resulting in traffic being dropped because it is incorrectly classified or in incorrect reporting figures being produced by high-speed logging (HSL).
Key facts
- CVSS score
- 5.8 (v3.1)
- Severity
- MEDIUM
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N- Weakness (CWE)
- CWE-284
- EPSS score
- 0.9% (59th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2021-7092)
- Published
- September 23, 2021
- NVD last modified
- June 17, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2021-7092 in the EU Vulnerability Database. Last updated in EUVD on November 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- cisco / ios xe
Certified products that may be affected
21 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Cisco Catalyst 9800 (40/80/L) Wireless Controllers running IOS-XE 16.12 - Cisco Systems, Inc. - FIPS 140 4606 - historical
- Cisco Aironet 1562e/i/d/ps, 2802e/i, 3802e/i/p, 4800 and IW6300H- AC/DC/DCW Wireless LAN Access Points, AireOS Version 8.10MR3 and IOS-XE 17.3 - Cisco Systems, Inc. - FIPS 140 4129 - historical
- Cisco Aggregation Services Router 1000 Series (ASR1K), Cisco Cloud Services Router 1000V (CSR1000V), Cisco Integrated Services Router 1100 Series (ISR1100), Cisco Integrated Services Router 4200 Series (ISR4K) running IOS-XE 17.3 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11186-2021 - archived
- Cisco Catalyst Industrial Ethernet 3x00 Rugged Series (IE3200, IE3300, IE3400, IE3400H) Switches running IOS-XE 17.3 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11177-2021 - archived
- Cisco Catalyst 9800 (40/80/L) Wireless Controllers running IOS-XE 16.12 - Cisco Systems, Inc. - FIPS 140 3883 - historical
See all 21 in the Security Certifications Explorer.
References
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain