CVE-2021-34728: Cisco IOS XR Software Authenticated User Privilege Escalation Vulnerabilities

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-09 · updated 2026-06-17
Weakness: CWE-78

Description

Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker with a low-privileged account to elevate privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

Cisco IOS XR Software: before 7.3.2; from 7.4.0 before 7.4.1 — fixed in 7.3.2, 7.4.1

How to fix

Upgrade to a fixed version: Cisco IOS XR Software 7.3.2, 7.4.1. Check the vendor advisory for mitigations.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privescal-dZYMrKf
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privescal-dZYMrKf

Get alerted when CVE-2021-34728 or the next vulnerability affects your stack