CVE-2021-34696

Cisco ASR 900 and ASR 920 Series Aggregation Services Routers Access Control List Bypass Vulnerability

MEDIUM

5.8

CVSS Score

Published: September 23, 2021 at 02:25 AM UTC

Updated: June 17, 2026 at 03:56 AM UTC

23 products affected across 1 vendorIOS XeAsr 903Asr 920-24Tz-M

Using Cisco IOS XE Software by Cisco?

Get instant alerts when new vulnerabilities affect Cisco IOS XE Software - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.8

Exploit prediction

EPSS 1.0%

SSVC

No known exploit

Description

A vulnerability in the access control list (ACL) programming of Cisco ASR 900 and ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incorrect programming of hardware when an ACL is configured using a method other than the configuration CLI. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

IOS Xe · Cisco

95%

v ≤ 17.3.2

cisco-asr-902 (environment) · cisco-asr-903 (environment) · cisco-asr-907 (environment) · cisco-asr-920-10sz-pd (environment) · cisco-asr-920-10sz-pd-r (environment) · cisco-asr-920-12cz-a (environment) · cisco-asr-920-12cz-a-r (environment) · cisco-asr-920-12cz-d (environment) · cisco-asr-920-12cz-d-r (environment) · cisco-asr-920-12sz-im (environment) · cisco-asr-920-12sz-im-r (environment) · cisco-asr-920-24sz-im (environment) · cisco-asr-920-24sz-im-r (environment) · cisco-asr-920-24sz-m (environment) · cisco-asr-920-24sz-m-r (environment) · cisco-asr-920-24tz-m (environment) · cisco-asr-920-24tz-m-r (environment) · cisco-asr-920-4sz-a (environment) · cisco-asr-920-4sz-a-r (environment) · cisco-asr-920-4sz-d (environment) · cisco-asr-920-4sz-d-r (environment) · cisco-asr-920u-12sz-im (environment)

Asr 902 · Ciscodevice

80%

All versions

Asr 903 · Ciscodevice

80%

All versions

Asr 907 · Ciscodevice

80%

All versions

Asr 920-10Sz-Pd · Ciscodevice

80%

All versions