What’s Vulnerable › Vulnerabilities
CVE-2021-27853: L2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers
- Severity: medium (CVSS 4.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2022-09-27 · updated 2026-06-17
- Weakness: CWE-290
Description
Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.
Affected products
- Cisco Catalyst 6503-E Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst 6504-E Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst 6506-E Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst 6509-E Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst 6509-Neb-A Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst 6509-V-E Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst 6513-E Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst 6800Ia Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst 6807-Xl Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst 6840-X Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst 6880-X Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst C6816-X-Le Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst C6824-X-Le-40G Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst C6832-X-Le Firmware: 15.5(01.01.85)sy07
- Cisco Catalyst C6840-X-Le-40G Firmware: 15.5(01.01.85)sy07
- Cisco IOS XE: 17.3.3, 15.2(07)e02, 15.2(07)e03, 17.4.1, 17.6.1
- Cisco Meraki Ms210 Firmware: all versions
- Cisco Meraki Ms225 Firmware: all versions
- Cisco Meraki Ms250 Firmware: all versions
- Cisco Meraki Ms350 Firmware: all versions
- Cisco Meraki Ms355 Firmware: all versions
- Cisco Meraki Ms390 Firmware: all versions
- Cisco Meraki Ms410 Firmware: all versions
- Cisco Meraki Ms420 Firmware: all versions
- Cisco Meraki Ms425 Firmware: all versions
- Cisco Meraki Ms450 Firmware: all versions
- Cisco N9K-C9316D-Gx Firmware: 9.3(5)
- Cisco N9K-C9332D-Gx2B Firmware: 9.3(5)
- Cisco N9K-C9348D-Gx2A Firmware: 9.3(5)
- Cisco N9K-C93600Cd-Gx Firmware: 9.3(5)
References
- https://blog.champtar.fr/VLAN0_LLC_SNAP/
- https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/
- https://kb.cert.org/vuls/id/855201
- https://standards.ieee.org/ieee/802.1Q/10323/
- https://standards.ieee.org/ieee/802.2/1048/
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX
- https://blog.champtar.fr/VLAN0_LLC_SNAP/
- https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/
- https://kb.cert.org/vuls/id/855201
- https://standards.ieee.org/ieee/802.1Q/10323/
- https://standards.ieee.org/ieee/802.2/1048/
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX
Get alerted when CVE-2021-27853 or the next vulnerability affects your stack