CVE-2021-34722: Cisco IOS XR Software Command Injection Vulnerabilities

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-09 · updated 2026-06-17
Weakness: CWE-78

Description

Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

Cisco IOS XR Software: from 7.1.1 before 7.3.2; from 7.4.0 before 7.4.1 — fixed in 7.3.2, 7.4.1

How to fix

Upgrade to a fixed version: Cisco IOS XR Software 7.3.2, 7.4.1. Check the vendor advisory for mitigations.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc

Get alerted when CVE-2021-34722 or the next vulnerability affects your stack