{
  "affected": [],
  "aliases": [
    "CVE-2021-27853"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-27T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.",
  "id": "GHSA-v8jg-p3fp-g968",
  "modified": "2022-10-04T00:00:20Z",
  "published": "2022-09-28T00:00:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27853"
    },
    {
      "type": "WEB",
      "url": "https://blog.champtar.fr/VLAN0_LLC_SNAP"
    },
    {
      "type": "WEB",
      "url": "https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08"
    },
    {
      "type": "WEB",
      "url": "https://kb.cert.org/vuls/id/855201"
    },
    {
      "type": "WEB",
      "url": "https://standards.ieee.org/ieee/802.1Q/10323"
    },
    {
      "type": "WEB",
      "url": "https://standards.ieee.org/ieee/802.2/1048"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "summary": "Cisco would like to thank Etienne Champetier for reporting these vulnerabilities and Cert/CC for the coordination."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "On September 27, 2022, the following vulnerabilities affecting Cisco products were disclosed by Cert/CC as part of VU855201, titled  L2 network security controls can be bypassed using VLAN 0 stacking and/or 802.3 headers [\"https://kb.cert.org/vuls/id/855201\"]:\r\n\r\nCVE-2021-27853: Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using a combination of VLAN 0 headers and LLC/SNAP headers.\r\nCVE-2021-27854: Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using a combination of VLAN 0 headers, LLC/SNAP headers in Ethernet to Wifi frame translation, and in the reverse\u2014Wifi to Ethernet.\r\nCVE-2021-27861: Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers).\r\nCVE-2021-27862: Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (and optionally VLAN0 headers).\r\n\r\nExploitation of these vulnerabilities could allow an adjacent attacker to bypass configured first-hop security (FHS) features on the affected Cisco products.\r\n\r\nFor more information about these vulnerabilities, see the Details [\"#details\"] section of this advisory.\r\n\r\nThis advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX [\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX\"]",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "The Vulnerable Products [\"#vp\"] section includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool [\"https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID\"] and will contain additional platform-specific information, including workarounds (if available) and fixed software releases (if available).\r\n\r\nAny product or service not listed in the Vulnerable Products [\"#vp\"] section of this advisory is to be considered not vulnerable.",
        "title": "Affected Products"
      },
      {
        "category": "general",
        "text": "CVE-2021-27853\r\nThe following table lists Cisco products that are affected by the vulnerability that is described in CVE-2021-27853. See the Details [\"#details\"] section of this advisory for more information about affected configurations.\r\n\r\nNote: End of life products have not been evaluated.\r\n        Cisco Product  Cisco Bug ID  Additional Information      Cisco IOS Software - Switches      Catalyst 6500 and 6800 Series Switches  CSCwa06145 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa06145\"]  Fixed software will not be made available.      Catalyst Digital Building Series Switches  CSCwa14942 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14942\"]  Fixed software will not be made available.      Industrial Ethernet Switches  CSCvw99743 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw99743\"]  Fixed software will not be made available.      Micro Switches  CSCwa14271 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14271\"]  Fixed software will not be made available.      Cisco IOS XE Software - Switches       Catalyst 4500 IOS-XE Switches  CSCwa18093 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa18093\"]  Fixed software will not be made available.      IOS XE Switches  CSCvz91291 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz91291\"]\r\nCSCwb01481 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwb01481\"]  CSCvz91291 affects Cisco IOS XE Software releases 17.6.1 and later. A fix is available for all FHS features except Dynamic ARP inspection.\r\n\r\nCSCwb01481 is relevant for Dynamic ARP Inspection and impacts all releases. Fixed Software will not be made available.      Cisco IOS XE Software - Routers      IOS XE Routers configured with Ethernet virtual circuits  CSCvz96133 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz96133\"]  Fixed software will not be made available.      Cisco IOS XR Software      IOS XR Routers configured with L2 Transport services  CSCvz88705 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz88705\"]\r\nCSCvz89602 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz89602\"]  Fixed software will not be made available.      Cisco Meraki - Switches      MS390  N/A  Impact is only for Dynamic ARP Inspection. Fixed software will not be made available.      MS210\r\nMS225\r\nMS250\r\nMS350\r\nMS355\r\nMS410\r\nMS420\r\nMS425\r\nMS450  N/A  Fixed software will not be made available.      Cisco NX-OS Software      Nexus 3000 Series Switches  CSCvx33758 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx33758\"]  Fixed software will not be made available.      Nexus 5500 Platform Switches\r\nNexus 5600 Platform Switches\r\nNexus 6000 Series Switches  CSCvx35087 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx35087\"]  Fixed software will not be made available.      Nexus 7000 Series Switches  CSCvx35085 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx35085\"]  Fixed software will not be made available.      Nexus 9000 Series Switches (Standalone Mode)  CSCvx33758 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx33758\"]  Fixed software will not be made available.      Cisco Small Business Switches      250 Series Smart Switches\r\n350 Series Managed Switches\r\n350X Series Stackable Managed Switches\r\n550X Series Stackable Managed Switches\r\nBusiness 250 Series Smart Switches\r\nBusiness 350 Series Managed Switches  CSCvw92154 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw92154\"]  Fixed software will not be made available.        CVE-2021-27854\r\nCisco Access Points\r\n\r\nCisco evaluated this vulnerability based on its impact on FHS features that are configured on Cisco Access Points. No impact was observed.\r\n\r\nAs part of the investigation into the impact to Cisco Access Points, another vulnerability was found, and a companion advisory has been published: Cisco Access Points VLAN Bypass from Native VLAN Vulnerability [\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apvlan-TDTtb4FY\"].\r\n  CVE-2021-27861\r\nThe following table lists Cisco products that are affected by the vulnerability that is described in CVE-2021-27861. See the Details [\"#details\"] section of this advisory for more information about affected configurations.\r\n\r\nNote: End of life products have not been evaluated.\r\n        Cisco Product  Cisco Bug ID  Additional Information      Cisco IOS Software - Switches      Catalyst 6500 and 6800 Series Switches  CSCwa06265 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa06265\"]  Fixed software will not be made available.      Catalyst Digital Building Series Switches  CSCwa14950 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14950\"]  Fixed software will not be made available.      Micro Switches  CSCwa14282 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14282\"]  Fixed software will not be made available.      Cisco IOS XR Software      IOS XR Routers configured with L2 Transport services  CSCwa04809 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa04809\"]  Fixed software will not be made available.      Cisco Meraki - Switches      MS210\r\nMS225\r\nMS250\r\nMS350\r\nMS355\r\nMS410\r\nMS420\r\nMS425\r\nMS450  N/A  Fixed software will not be made available.      Cisco NX-OS Software      Nexus 3000 Series Switches  CSCwa01097 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa01097\"]  Fixed software will not be made available.      Nexus 5500 Platform Switches\r\nNexus 5600 Platform Switches\r\nNexus 6000 Series Switches  CSCwa18209 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa18209\"]  Fixed software will not be made available.      Nexus 7000 Series Switches  CSCwa18310 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa18310\"]  Fixed software will not be made available.      Nexus 9000 Series Switches (Standalone Mode)  CSCwa01097 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa01097\"]  Fixed software will not be made available.      Cisco Small Business Switches      250 Series Smart Switches\r\n350 Series Managed Switches\r\n350X Series Stackable Managed Switches\r\n550X Series Stackable Managed Switches\r\nBusiness 250 Series Smart Switches\r\nBusiness 350 Series Managed Switches  CSCwa09081 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa09081\"]  Fixed software will not be made available.        CVE-2021-27862\r\nCisco evaluated this vulnerability based on its impact on FHS features that are configured on Cisco Access points. No impact was observed.",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.\r\n  CVE-2021-27853\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nONT Switches\r\n\r\nCatalyst PON Series Switches\r\n\r\nIOS Switches\r\n\r\nCatalyst 1000 Series Switches\r\n\r\nIOS XE Platforms\r\n\r\nCatalyst 8000 Series Edge Platforms\r\n\r\nNX-OS Software\r\n\r\n\r\nMDS 9000 Series Multilayer Switches\r\nNexus 1000V Series Switches\r\nNexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode\r\nUCS 6x00 Series Fabric Interconnects\r\n\r\nMeraki Switches\r\n\r\nGS110 Switches\r\nMS22 Switches\r\nMS42 Switches\r\nMS120 Switches\r\nMS125 Switches\r\nMS220 Switches\r\nMS320 Switches\r\n  CVE-2021-27854\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nAccess Points\r\nAireOS Access Points\r\nMeraki Access Points\r\n  CVE-2021-27861\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nONT Switches\r\n\r\nCatalyst PON Series Switches\r\n\r\nIOS Switches\r\n\r\nCatalyst 1000 Series Switches\r\nIndustrial Ethernet Switches\r\n\r\nIOS XE Routers\r\n\r\nIOS XE Routers when configured with Ethernet virtual circuits\r\n\r\nIOS XE Software Switches\r\n\r\nCatalyst 3650 Series Switches\r\nCatalyst 3850 Series Switches\r\nCatalyst 4500E and 4500X Series Switches\r\nCatalyst 9000 Series Switches\r\n\r\nMeraki Switches\r\n\r\nGS110 Switches\r\nMS22 Switches\r\nMS42 Switches\r\nMS120 Switches\r\nMS125 Switches\r\nMS220 Switches\r\nMS320 Switches\r\nMS390 Switches\r\n\r\nNX-OS Software\r\n\r\n\r\nMDS 9000 Series Multilayer Switches\r\nNexus 1000V Series Switches\r\nNexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode\r\nUCS 6x00 Series Fabric Interconnects\r\n  CVE-2021-27862\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nAccess Points\r\nAireOS Access Points\r\nMeraki Access Points",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit another vulnerability. In addition, a software release that is affected by one of the vulnerabilities may not be affected by the other vulnerabilities.\r\n  CVE-2021-27853\r\nA vulnerability in the processing of stacked Ethernet tag headers of multiple Cisco products could allow an unauthenticated, adjacent attacker to bypass the FHS feature of an affected device.\r\n\r\nThis vulnerability is due to the platforms forwarding frames when the upper-layer protocol cannot be determined to invoke a Layer 3 FHS feature. An attacker could exploit this vulnerability by sending packets with stacked VLAN Ethernet headers. A successful exploit could allow the attacker to bypass the FHS feature of an affected device.\r\n\r\nCisco has not released software updates that address this vulnerability. There are workarounds that address this vulnerability.\r\n\r\nCVE ID: CVE-2021-27853\r\nSecurity Impact Rating (SIR): Medium\r\nCVSS Base Score: 4.7\r\nCVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N\r\n\r\nCVE-2021-27853: Additional Details\r\n\r\nThe IEEE Std 802.1Q-2018 standard incorporates a priority-tagged frame whose tag header carries priority information but no VLAN identification information. The VLAN identifier is set to 0 and is typically carried in a single 802.1Q header between the source MAC address and the Ethertype/size field.\r\n\r\nIn networks where VLAN tagging is used, there is typically a single 802.1Q header between the source MAC address and the Ethertype/size field. IEEE 802.1AD has double tagging and includes the S-TAG and C-TAG headers between the source MAC address and the Ethertype/size field.\r\n\r\nThe IEEE Std 802.1Q-2018 does not specify that there should be no more than two tags present, but Cisco products have a limit on how many tags can be inspected to establish the upper-layer protocols (determined by the Ethertype field), whether a packet is classified as IPv4 or IPv6, and whether it is subject to additional Layer 3 feature processing. If these things cannot be determined, the packet is forwarded based on the Layer 2 information, depending on the device configuration.\r\n\r\nDepending on the implementation of the next device that receives the frame, the frame may be dropped as invalid or the priority tags may be removed and processed. These actions are dependent on the implementation of the receiving host operating system.\r\n  CVE-2021-27853: Cisco Network Operating Systems\r\nThis section provides specific details about how the different affected Cisco network operating systems handle Ethernet frames with a VLAN ID 0 tag.\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nBy default, all of the affected Cisco IOS Switches process inbound packets with the frame header that contains a VLAN ID 0 tag. Cisco products have a limit on how many tags can be inspected to establish the upper-layer protocols.\r\n\r\nNote: Cisco IOS Switches that have reached end of life have not been evaluated by the Cisco Product Security Incident Response Team (PSIRT).\r\n\r\nCisco IOS XE Software \u2013 Switches\r\n\r\nBy default, Cisco Catalyst 4500E Series switches process an inbound packet with the frame header that contains a VLAN ID 0 tag. Cisco products have a limit on how many tags can be inspected to establish the upper-layer protocols.\r\n\r\nThe default behavior of a Cisco IOS XE Switch is to drop all traffic that has a frame header that contains a VLAN ID 0 tag. The switch only processes frames with a VLAN ID 0 tag if the access port is configured as follows:\r\n\r\n\r\nswitchport voice vlan dot1p\r\n\r\nCisco IOS XE Software \u2013 Routers\r\n\r\nCisco IOS XE devices that are configured with service instances handle the VLAN ID 0 tag in accordance with their configurations. For VLAN-based services, the top one or two tags are inspected based on configuration and map to the appropriate service instance on the longest match rules.\r\n\r\nService instance-based configurations that contain encapsulation dot1q priority-tagged, encapsulation dot1q priority-tagged exact, or encapsulation default are affected by this vulnerability.\r\n\r\nThe order of matching a service instance for VLAN ID 0 is based on encapsulation dot1q priority-tagged first and then encapsulation default. Cisco IOS XE Software does not match on encapsulation dot1q any for VLAN ID 0 tags.\r\n\r\nCisco IOS XR Software\r\n\r\nCisco IOS XR Software running on Layer 2 Transport interfaces handles a VLAN ID 0 tag in accordance with the configurations applied to the device. For port-based services, the packets are forwarded with no inspection. For VLAN-based services, either the top tag or the top two tags are inspected based on configuration and map to the appropriate attachment circuit based on the longest match rules. Fore more information, see IOS XR L2VPN Services and Features [\"https://www.cisco.com/c/en/us/support/docs/routers/asr-9000-series-aggregation-services-routers/116453-technote-ios-xr-l2vpn-00.html#anc6\"].\r\n\r\nConfigurations that contain encapsulation dot1q priority-tagged, encapsulation dot1q priority-tagged exact, or encapsulation default on Layer 2 Transport VLAN-based configurations are affected by this vulnerability.\r\n\r\nCisco NX-OS Software\r\n\r\nBy default, Cisco NX-OS Software processes an inbound packet with the frame header containing a VLAN ID 0 tag. The initial VLAN ID 0 tag is stripped and then processed in accordance with the rest of the packet contents. Cisco products have a limit on how many tags can be inspected to establish the upper-layer protocols.\r\n\r\nCisco Small Business Switches\r\n\r\nBy default, Cisco Small Business Switches process an inbound packet with the frame header that contains a VLAN ID 0 tag. Cisco products have a limit on how many tags can be inspected to establish the upper-layer protocols.\r\n    CVE-2021-27854\r\nCVE-2021-27854 examines the way frames are converted between 802.11 and 802.3 with the injection of VLAN tags in the SNAP headers.\r\n\r\nCisco evaluated this vulnerability for any impact to the security features on wireless access points when handling these frame conversions. Cisco found that no configured FHS features were bypassed.\r\n\r\nCVE ID: CVE-2021-27854\r\nSecurity Impact Rating (SIR): Medium\r\nCVSS Base Score: 4.7\r\nCVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N\r\n    CVE-2021-27861\r\nA vulnerability in the Ethernet processing of multiple Cisco products could allow an unauthenticated, adjacent attacker to bypass the FHS feature of an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of SNAP/LLC Ethernet frames. An attacker could exploit this vulnerability by sending packets with a crafted (or not crafted, depending on the product) SNAP/LLC Ethernet header. A successful exploit could allow the attacker to bypass the FHS feature of an affected device.\r\n\r\nCisco has not released software updates that address this vulnerability. There are workarounds that address this vulnerability for some products.\r\n\r\nCVE ID: CVE-2021-27861\r\nSecurity Impact Rating (SIR): Medium\r\nCVSS Base Score: 4.7\r\nCVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N\r\n  CVE-2021-27861: Cisco Network Operating Systems\r\nThis section provides specific details about how the different affected Cisco network operating systems handle SNAP/LLC Ethernet frames.\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nThe affected Cisco IOS Software products forward SNAP/LLC frames without additional FHS feature inspection.\r\n\r\nCisco IOS XR Software\r\n\r\nThe affected Cisco IOS XR Software products forward SNAP/LLC frames without additional FHS feature inspection.\r\n\r\nCisco NX-OS Software\r\n\r\nThe affected Cisco NX-OS Software products forward SNAP/LLC frames without any additional FHS feature inspection.\r\n\r\nCisco Small Business Switches\r\n\r\nThe affected Cisco Small Business Switches correctly apply FHS features for SNAP/LLC frames with a length field of up to 1,500. However, SNAP/LLC frames with lengths of 1,501 through 1,535 are forwarded without additional FHS feature inspection.\r\n    CVE-2021-27862\r\nCVE-2021-27862 examines the way frames are converted between 802.3 to 802.11 and the length field.\r\n\r\nCisco evaluated this vulnerability for any impact to the security features on wireless access points when handling these frame conversions. Cisco found that no configured FHS features were bypassed.\r\n\r\nCVE ID: CVE-2021-27862\r\nSecurity Impact Rating (SIR): Medium\r\nCVSS Base Score: 4.7\r\nCVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
        "title": "Details"
      },
      {
        "category": "general",
        "text": "There are workarounds that address some of these vulnerabilities.\r\n    CVE-2021-27853\r\nAdministrators may drop packets that cannot have their ethertype detected using a Layer 2 access control list (ACL) or where tags are not expected to drop tagged traffic. If a single dot1P header is received, it will still be processed correctly if the network operating system supports it.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHS has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\n\r\n!\r\nmac access-list extended CSCwa14271\r\n permit any any 0x86DD 0x0\r\n permit any any 0x800 0x0\r\n permit any any 0x806 0x0\r\n deny   any any\r\n!\r\ninterface GigabitEthernet1/0/1\r\n switchport access vlan 5\r\n switchport voice vlan dot1p\r\n ipv6 nd raguard attach-policy HOSTS\r\n mac access-group CSCwa14271 in\r\n!\r\n\r\nCisco IOS XE Software \u2013 Switches\r\n\r\nFor Cisco IOS XE Software on switches, impact to all FHS features occurs on Cisco IOS Software releases 17.6.1 and later, but earlier than the first fixed release. The issue will not be seen if the access port VLAN also has an active switched virtual interface (SVI). If there are access ports in VLAN 5, for example, this issue will be observed only if interface vlan 5 is not configured. To mitigate this issue for vulnerable releases of Cisco IOS Software, administrators can ensure that each VLAN assigned to access ports has a corresponding SVI configured.\r\n\r\nFor Cisco IOS XE Software on switches, Dynamic ARP Inspection is affected on all releases. Administrators can configure static ARP entries for the default gateways and critical servers and hosts off the segments that are being protected to protect the critical assets in the environment.\r\n\r\nCisco IOS XE Software \u2013 Routers\r\n\r\nFor configurations that have a service instance with encapsulation priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can either add the keyword exact after the encapsulation priority-tagged or filter on the ethertype field with encapsulation priority-tagged etype ipv4 , ipv6.\r\n\r\nFor environments that do not have encapsulation priority-tagged assigned to a service instance, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure a service instance that is not assigned to a bridge domain with encapsulation priority-tagged.\r\n\r\nCisco IOS XR Software\r\n\r\nFor configurations that have an l2transport sub interface configured with encapsulation dot1q|dot1ad priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can add the keyword exact after the encapsulation dot1q|dot1ad priority-tagged.\r\n\r\nFor environments that do not have encapsulation dot1q|dot1ad priority-tagged assigned to an l2transport sub interface, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure l2transport sub interfaces that are not assigned to a bridge domain with encapsulation dot1q priority-tagged and encapsulation dot1ad priority-tagged.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\nmac access-list drop_three_tags\r\n deny any any 0x8100\r\n deny any any 0x88a8\r\n permit any any\r\n!\r\ninterface ethernet 1/4\r\n mac port access-group drop_three_tags\r\n!\r\n\r\n\r\nCisco Small Business Switches\r\n\r\nTo ensure that FHS works correctly on access ports, install a MAC ACL to deny only tagged frames (because they are not to be expected on an access port) or to permit only ARP, IPv4, and IPv6 on all access ports. The following is an example from the Cisco Sx250, 350, and 550 Series Smart Switches and the Cisco Business 250 and 350 Series Smart Switches:\r\n\r\n\r\nmac access-list extended arp-ip-ip6\r\npermit any any 806 0000 ace-priority 1\r\npermit any any 800 0000 ace-priority 2\r\npermit any any 86dd 0000 ace-priority 3\r\n\r\n\r\n      CVE-2021-27861\r\nThe principle for mitigating CVE-2021-27861 is to drop any packets that cannot have their Layer 3 protocol detected using a Layer 2 ACL.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHP has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco IOS XR Software\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\ninterface Ethernet1/3\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy HOSTS\r\n!\r\ninterface Ethernet1/4\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy CSCvw92154\r\n!\r\nmac access-list drop_non\r\n  10 permit any any 0x86dd\r\n  20 permit any any ip\r\n  30 permit any any 0x806\r\n  35 permit any 0100.0ccc.cccc 0000.0000.0000\r\n  40 deny any any\r\n!\r\n\r\nCisco Small Business Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nWhile these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "When considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.\r\n    Fixed Releases    CVE-2021-27853\r\nAt the time of publication, the release information in the following table was accurate. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.\r\n        Product  Cisco Bug ID  First Fixed Release          Cisco IOS XE Switches  CSCvz91291 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz91291\"]  17.6.3\r\n17.8.1            CVE-2021-27854\r\nCisco evaluated this vulnerability based on its impact on FHS features configured on the access points. No impact was observed.\r\n      CVE-2021-27861\r\nAt the time of publication, Cisco had not released updates that address this vulnerability for any Cisco product.\r\n      CVE-2021-27862\r\nCisco evaluated this vulnerability based on its impact on FHS features configured on the access points. No impact was observed.\r\n\r\nThe Cisco PSIRT validates only the affected and fixed release information that is documented in this advisory.",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "Cisco would like to thank Etienne Champetier for reporting these vulnerabilities and Cert/CC for the coordination.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "Emergency Support:\r\n+1 877 228 7302 (toll-free within North America)\r\n+1 408 525 6532 (International direct-dial)\r\nNon-emergency Support:\r\nEmail: psirt@cisco.com\r\nSupport requests that are received via e-mail are typically acknowledged within 48 hours.",
      "issuing_authority": "Cisco product security incident response is the responsibility of the Cisco Product Security Incident Response Team (PSIRT). The Cisco PSIRT is a dedicated, global team that manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks. The on-call Cisco PSIRT works 24x7 with Cisco customers, independent security researchers, consultants, industry organizations, and other vendors to identify possible security issues with Cisco products and networks.\r\nMore information can be found in Cisco Security Vulnerability Policy available at https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerabilities in Layer 2 Network Security Controls Affecting Cisco Products: September 2022",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "L2 network security controls can be bypassed using VLAN 0 stacking and/or 802.3 headers",
        "url": "https://kb.cert.org/vuls/id/855201"
      },
      {
        "category": "external",
        "summary": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX"
      },
      {
        "category": "external",
        "summary": "Cisco\u0026nbsp;Bug Search Tool",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID"
      },
      {
        "category": "external",
        "summary": "CSCwa06145",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa06145"
      },
      {
        "category": "external",
        "summary": "CSCwa14942",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14942"
      },
      {
        "category": "external",
        "summary": "CSCvw99743",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw99743"
      },
      {
        "category": "external",
        "summary": "CSCwa14271",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14271"
      },
      {
        "category": "external",
        "summary": "CSCwa18093",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa18093"
      },
      {
        "category": "external",
        "summary": "CSCvz91291",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz91291"
      },
      {
        "category": "external",
        "summary": "CSCwb01481",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwb01481"
      },
      {
        "category": "external",
        "summary": "CSCvz96133",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz96133"
      },
      {
        "category": "external",
        "summary": "CSCvz88705",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz88705"
      },
      {
        "category": "external",
        "summary": "CSCvz89602",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz89602"
      },
      {
        "category": "external",
        "summary": "CSCvx33758",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx33758"
      },
      {
        "category": "external",
        "summary": "CSCvx35087",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx35087"
      },
      {
        "category": "external",
        "summary": "CSCvx35085",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx35085"
      },
      {
        "category": "external",
        "summary": "CSCvx33758",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx33758"
      },
      {
        "category": "external",
        "summary": "CSCvw92154",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw92154"
      },
      {
        "category": "external",
        "summary": "Cisco\u0026nbsp;Access Points VLAN Bypass from Native VLAN Vulnerability",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apvlan-TDTtb4FY"
      },
      {
        "category": "external",
        "summary": "CSCwa06265",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa06265"
      },
      {
        "category": "external",
        "summary": "CSCwa14950",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14950"
      },
      {
        "category": "external",
        "summary": "CSCwa14282",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14282"
      },
      {
        "category": "external",
        "summary": "CSCwa04809",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa04809"
      },
      {
        "category": "external",
        "summary": "CSCwa01097",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa01097"
      },
      {
        "category": "external",
        "summary": "CSCwa18209",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa18209"
      },
      {
        "category": "external",
        "summary": "CSCwa18310",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa18310"
      },
      {
        "category": "external",
        "summary": "CSCwa01097",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa01097"
      },
      {
        "category": "external",
        "summary": "CSCwa09081",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa09081"
      },
      {
        "category": "external",
        "summary": "IOS XR L2VPN Services and Features",
        "url": "https://www.cisco.com/c/en/us/support/docs/routers/asr-9000-series-aggregation-services-routers/116453-technote-ios-xr-l2vpn-00.html#anc6"
      },
      {
        "category": "external",
        "summary": "considering software upgrades",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "Cisco\u0026nbsp;Security Advisories page",
        "url": "https://www.cisco.com/go/psirt"
      },
      {
        "category": "external",
        "summary": "CSCvz91291",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz91291"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      }
    ],
    "title": "Vulnerabilities in Layer 2 Network Security Controls Affecting Cisco Products: September 2022",
    "tracking": {
      "current_release_date": "2022-10-05T18:16:08+00:00",
      "generator": {
        "date": "2022-10-22T03:15:47+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-VU855201-J3z8CKTX",
      "initial_release_date": "2022-09-27T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2022-09-27T16:38:06+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        },
        {
          "date": "2022-10-05T18:16:08+00:00",
          "number": "1.1.0",
          "summary": "Corrected affected product information."
        }
      ],
      "status": "final",
      "version": "1.1.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "IOS",
            "product": {
              "name": "Cisco IOS ",
              "product_id": "CSAFPID-2097"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco IOS XR Software",
            "product": {
              "name": "Cisco IOS XR Software ",
              "product_id": "CSAFPID-5834"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco NX-OS Software",
            "product": {
              "name": "Cisco NX-OS Software ",
              "product_id": "CSAFPID-80720"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco IOS XE Software",
            "product": {
              "name": "Cisco IOS XE Software ",
              "product_id": "CSAFPID-93036"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Aironet Access Point Software",
            "product": {
              "name": "Cisco Aironet Access Point Software ",
              "product_id": "CSAFPID-190024"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Small Business Smart and Managed Switches",
            "product": {
              "name": "Cisco Small Business Smart and Managed Switches ",
              "product_id": "CSAFPID-278027"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-27862",
      "notes": [
        {
          "category": "other",
          "text": "Not available.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "remediations": [
        {
          "category": "workaround",
          "details": "There are workarounds that address some of these vulnerabilities.\r\n    CVE-2021-27853\r\nAdministrators may drop packets that cannot have their ethertype detected using a Layer 2 access control list (ACL) or where tags are not expected to drop tagged traffic. If a single dot1P header is received, it will still be processed correctly if the network operating system supports it.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHS has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\n\r\n!\r\nmac access-list extended CSCwa14271\r\n permit any any 0x86DD 0x0\r\n permit any any 0x800 0x0\r\n permit any any 0x806 0x0\r\n deny   any any\r\n!\r\ninterface GigabitEthernet1/0/1\r\n switchport access vlan 5\r\n switchport voice vlan dot1p\r\n ipv6 nd raguard attach-policy HOSTS\r\n mac access-group CSCwa14271 in\r\n!\r\n\r\nCisco IOS XE Software \u2013 Switches\r\n\r\nFor Cisco IOS XE Software on switches, impact to all FHS features occurs on Cisco IOS Software releases 17.6.1 and later, but earlier than the first fixed release. The issue will not be seen if the access port VLAN also has an active switched virtual interface (SVI). If there are access ports in VLAN 5, for example, this issue will be observed only if interface vlan 5 is not configured. To mitigate this issue for vulnerable releases of Cisco IOS Software, administrators can ensure that each VLAN assigned to access ports has a corresponding SVI configured.\r\n\r\nFor Cisco IOS XE Software on switches, Dynamic ARP Inspection is affected on all releases. Administrators can configure static ARP entries for the default gateways and critical servers and hosts off the segments that are being protected to protect the critical assets in the environment.\r\n\r\nCisco IOS XE Software \u2013 Routers\r\n\r\nFor configurations that have a service instance with encapsulation priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can either add the keyword exact after the encapsulation priority-tagged or filter on the ethertype field with encapsulation priority-tagged etype ipv4 , ipv6.\r\n\r\nFor environments that do not have encapsulation priority-tagged assigned to a service instance, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure a service instance that is not assigned to a bridge domain with encapsulation priority-tagged.\r\n\r\nCisco IOS XR Software\r\n\r\nFor configurations that have an l2transport sub interface configured with encapsulation dot1q|dot1ad priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can add the keyword exact after the encapsulation dot1q|dot1ad priority-tagged.\r\n\r\nFor environments that do not have encapsulation dot1q|dot1ad priority-tagged assigned to an l2transport sub interface, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure l2transport sub interfaces that are not assigned to a bridge domain with encapsulation dot1q priority-tagged and encapsulation dot1ad priority-tagged.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\nmac access-list drop_three_tags\r\n deny any any 0x8100\r\n deny any any 0x88a8\r\n permit any any\r\n!\r\ninterface ethernet 1/4\r\n mac port access-group drop_three_tags\r\n!\r\n\r\n\r\nCisco Small Business Switches\r\n\r\nTo ensure that FHS works correctly on access ports, install a MAC ACL to deny only tagged frames (because they are not to be expected on an access port) or to permit only ARP, IPv4, and IPv6 on all access ports. The following is an example from the Cisco Sx250, 350, and 550 Series Smart Switches and the Cisco Business 250 and 350 Series Smart Switches:\r\n\r\n\r\nmac access-list extended arp-ip-ip6\r\npermit any any 806 0000 ace-priority 1\r\npermit any any 800 0000 ace-priority 2\r\npermit any any 86dd 0000 ace-priority 3\r\n\r\n\r\n      CVE-2021-27861\r\nThe principle for mitigating CVE-2021-27861 is to drop any packets that cannot have their Layer 3 protocol detected using a Layer 2 ACL.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHP has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco IOS XR Software\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\ninterface Ethernet1/3\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy HOSTS\r\n!\r\ninterface Ethernet1/4\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy CSCvw92154\r\n!\r\nmac access-list drop_non\r\n  10 permit any any 0x86dd\r\n  20 permit any any ip\r\n  30 permit any any 0x806\r\n  35 permit any 0100.0ccc.cccc 0000.0000.0000\r\n  40 deny any any\r\n!\r\n\r\nCisco Small Business Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nWhile these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment."
        }
      ],
      "title": "VU855201: When converting from 802.3 (LLC/SNAP) to 802.11, Linux ignore the length field. "
    },
    {
      "cve": "CVE-2021-27853",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvz96133"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa18093"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvz91291"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwb01481"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa14271"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa06145"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa14942"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvw99743"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvx33758"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvx35087"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvx35085"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvz89602"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvz88705"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvw92154"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-93036",
          "CSAFPID-2097",
          "CSAFPID-80720",
          "CSAFPID-5834",
          "CSAFPID-278027"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-93036",
            "CSAFPID-80720",
            "CSAFPID-278027",
            "CSAFPID-2097",
            "CSAFPID-5834"
          ],
          "url": "https://software.cisco.com"
        },
        {
          "category": "workaround",
          "details": "There are workarounds that address some of these vulnerabilities.\r\n    CVE-2021-27853\r\nAdministrators may drop packets that cannot have their ethertype detected using a Layer 2 access control list (ACL) or where tags are not expected to drop tagged traffic. If a single dot1P header is received, it will still be processed correctly if the network operating system supports it.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHS has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\n\r\n!\r\nmac access-list extended CSCwa14271\r\n permit any any 0x86DD 0x0\r\n permit any any 0x800 0x0\r\n permit any any 0x806 0x0\r\n deny   any any\r\n!\r\ninterface GigabitEthernet1/0/1\r\n switchport access vlan 5\r\n switchport voice vlan dot1p\r\n ipv6 nd raguard attach-policy HOSTS\r\n mac access-group CSCwa14271 in\r\n!\r\n\r\nCisco IOS XE Software \u2013 Switches\r\n\r\nFor Cisco IOS XE Software on switches, impact to all FHS features occurs on Cisco IOS Software releases 17.6.1 and later, but earlier than the first fixed release. The issue will not be seen if the access port VLAN also has an active switched virtual interface (SVI). If there are access ports in VLAN 5, for example, this issue will be observed only if interface vlan 5 is not configured. To mitigate this issue for vulnerable releases of Cisco IOS Software, administrators can ensure that each VLAN assigned to access ports has a corresponding SVI configured.\r\n\r\nFor Cisco IOS XE Software on switches, Dynamic ARP Inspection is affected on all releases. Administrators can configure static ARP entries for the default gateways and critical servers and hosts off the segments that are being protected to protect the critical assets in the environment.\r\n\r\nCisco IOS XE Software \u2013 Routers\r\n\r\nFor configurations that have a service instance with encapsulation priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can either add the keyword exact after the encapsulation priority-tagged or filter on the ethertype field with encapsulation priority-tagged etype ipv4 , ipv6.\r\n\r\nFor environments that do not have encapsulation priority-tagged assigned to a service instance, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure a service instance that is not assigned to a bridge domain with encapsulation priority-tagged.\r\n\r\nCisco IOS XR Software\r\n\r\nFor configurations that have an l2transport sub interface configured with encapsulation dot1q|dot1ad priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can add the keyword exact after the encapsulation dot1q|dot1ad priority-tagged.\r\n\r\nFor environments that do not have encapsulation dot1q|dot1ad priority-tagged assigned to an l2transport sub interface, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure l2transport sub interfaces that are not assigned to a bridge domain with encapsulation dot1q priority-tagged and encapsulation dot1ad priority-tagged.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\nmac access-list drop_three_tags\r\n deny any any 0x8100\r\n deny any any 0x88a8\r\n permit any any\r\n!\r\ninterface ethernet 1/4\r\n mac port access-group drop_three_tags\r\n!\r\n\r\n\r\nCisco Small Business Switches\r\n\r\nTo ensure that FHS works correctly on access ports, install a MAC ACL to deny only tagged frames (because they are not to be expected on an access port) or to permit only ARP, IPv4, and IPv6 on all access ports. The following is an example from the Cisco Sx250, 350, and 550 Series Smart Switches and the Cisco Business 250 and 350 Series Smart Switches:\r\n\r\n\r\nmac access-list extended arp-ip-ip6\r\npermit any any 806 0000 ace-priority 1\r\npermit any any 800 0000 ace-priority 2\r\npermit any any 86dd 0000 ace-priority 3\r\n\r\n\r\n      CVE-2021-27861\r\nThe principle for mitigating CVE-2021-27861 is to drop any packets that cannot have their Layer 3 protocol detected using a Layer 2 ACL.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHP has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco IOS XR Software\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\ninterface Ethernet1/3\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy HOSTS\r\n!\r\ninterface Ethernet1/4\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy CSCvw92154\r\n!\r\nmac access-list drop_non\r\n  10 permit any any 0x86dd\r\n  20 permit any any ip\r\n  30 permit any any 0x806\r\n  35 permit any 0100.0ccc.cccc 0000.0000.0000\r\n  40 deny any any\r\n!\r\n\r\nCisco Small Business Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nWhile these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.",
          "product_ids": [
            "CSAFPID-93036",
            "CSAFPID-2097",
            "CSAFPID-80720",
            "CSAFPID-5834",
            "CSAFPID-278027"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-93036",
            "CSAFPID-2097",
            "CSAFPID-80720",
            "CSAFPID-5834",
            "CSAFPID-278027"
          ]
        }
      ],
      "title": "VU855201: 802.1Q VID0 Headers can bypass First Hop Security Affecting Cisco Products"
    },
    {
      "cve": "CVE-2021-27861",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa18209"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa01097"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa18310"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa14282"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa14950"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa06265"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa09081"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa04809"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-80720",
          "CSAFPID-2097",
          "CSAFPID-278027",
          "CSAFPID-5834"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-80720",
            "CSAFPID-278027",
            "CSAFPID-2097",
            "CSAFPID-5834"
          ],
          "url": "https://software.cisco.com"
        },
        {
          "category": "workaround",
          "details": "There are workarounds that address some of these vulnerabilities.\r\n    CVE-2021-27853\r\nAdministrators may drop packets that cannot have their ethertype detected using a Layer 2 access control list (ACL) or where tags are not expected to drop tagged traffic. If a single dot1P header is received, it will still be processed correctly if the network operating system supports it.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHS has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\n\r\n!\r\nmac access-list extended CSCwa14271\r\n permit any any 0x86DD 0x0\r\n permit any any 0x800 0x0\r\n permit any any 0x806 0x0\r\n deny   any any\r\n!\r\ninterface GigabitEthernet1/0/1\r\n switchport access vlan 5\r\n switchport voice vlan dot1p\r\n ipv6 nd raguard attach-policy HOSTS\r\n mac access-group CSCwa14271 in\r\n!\r\n\r\nCisco IOS XE Software \u2013 Switches\r\n\r\nFor Cisco IOS XE Software on switches, impact to all FHS features occurs on Cisco IOS Software releases 17.6.1 and later, but earlier than the first fixed release. The issue will not be seen if the access port VLAN also has an active switched virtual interface (SVI). If there are access ports in VLAN 5, for example, this issue will be observed only if interface vlan 5 is not configured. To mitigate this issue for vulnerable releases of Cisco IOS Software, administrators can ensure that each VLAN assigned to access ports has a corresponding SVI configured.\r\n\r\nFor Cisco IOS XE Software on switches, Dynamic ARP Inspection is affected on all releases. Administrators can configure static ARP entries for the default gateways and critical servers and hosts off the segments that are being protected to protect the critical assets in the environment.\r\n\r\nCisco IOS XE Software \u2013 Routers\r\n\r\nFor configurations that have a service instance with encapsulation priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can either add the keyword exact after the encapsulation priority-tagged or filter on the ethertype field with encapsulation priority-tagged etype ipv4 , ipv6.\r\n\r\nFor environments that do not have encapsulation priority-tagged assigned to a service instance, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure a service instance that is not assigned to a bridge domain with encapsulation priority-tagged.\r\n\r\nCisco IOS XR Software\r\n\r\nFor configurations that have an l2transport sub interface configured with encapsulation dot1q|dot1ad priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can add the keyword exact after the encapsulation dot1q|dot1ad priority-tagged.\r\n\r\nFor environments that do not have encapsulation dot1q|dot1ad priority-tagged assigned to an l2transport sub interface, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure l2transport sub interfaces that are not assigned to a bridge domain with encapsulation dot1q priority-tagged and encapsulation dot1ad priority-tagged.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\nmac access-list drop_three_tags\r\n deny any any 0x8100\r\n deny any any 0x88a8\r\n permit any any\r\n!\r\ninterface ethernet 1/4\r\n mac port access-group drop_three_tags\r\n!\r\n\r\n\r\nCisco Small Business Switches\r\n\r\nTo ensure that FHS works correctly on access ports, install a MAC ACL to deny only tagged frames (because they are not to be expected on an access port) or to permit only ARP, IPv4, and IPv6 on all access ports. The following is an example from the Cisco Sx250, 350, and 550 Series Smart Switches and the Cisco Business 250 and 350 Series Smart Switches:\r\n\r\n\r\nmac access-list extended arp-ip-ip6\r\npermit any any 806 0000 ace-priority 1\r\npermit any any 800 0000 ace-priority 2\r\npermit any any 86dd 0000 ace-priority 3\r\n\r\n\r\n      CVE-2021-27861\r\nThe principle for mitigating CVE-2021-27861 is to drop any packets that cannot have their Layer 3 protocol detected using a Layer 2 ACL.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHP has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco IOS XR Software\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\ninterface Ethernet1/3\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy HOSTS\r\n!\r\ninterface Ethernet1/4\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy CSCvw92154\r\n!\r\nmac access-list drop_non\r\n  10 permit any any 0x86dd\r\n  20 permit any any ip\r\n  30 permit any any 0x806\r\n  35 permit any 0100.0ccc.cccc 0000.0000.0000\r\n  40 deny any any\r\n!\r\n\r\nCisco Small Business Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nWhile these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.",
          "product_ids": [
            "CSAFPID-80720",
            "CSAFPID-2097",
            "CSAFPID-278027",
            "CSAFPID-5834"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-80720",
            "CSAFPID-2097",
            "CSAFPID-278027",
            "CSAFPID-5834"
          ]
        }
      ],
      "title": "VU855201: SNAP/LLC Headers can bypass First Hop Security Affecting Cisco Products"
    },
    {
      "cve": "CVE-2021-27854",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvx37987"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-190024"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-190024"
          ],
          "url": "https://software.cisco.com"
        },
        {
          "category": "workaround",
          "details": "There are workarounds that address some of these vulnerabilities.\r\n    CVE-2021-27853\r\nAdministrators may drop packets that cannot have their ethertype detected using a Layer 2 access control list (ACL) or where tags are not expected to drop tagged traffic. If a single dot1P header is received, it will still be processed correctly if the network operating system supports it.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHS has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\n\r\n!\r\nmac access-list extended CSCwa14271\r\n permit any any 0x86DD 0x0\r\n permit any any 0x800 0x0\r\n permit any any 0x806 0x0\r\n deny   any any\r\n!\r\ninterface GigabitEthernet1/0/1\r\n switchport access vlan 5\r\n switchport voice vlan dot1p\r\n ipv6 nd raguard attach-policy HOSTS\r\n mac access-group CSCwa14271 in\r\n!\r\n\r\nCisco IOS XE Software \u2013 Switches\r\n\r\nFor Cisco IOS XE Software on switches, impact to all FHS features occurs on Cisco IOS Software releases 17.6.1 and later, but earlier than the first fixed release. The issue will not be seen if the access port VLAN also has an active switched virtual interface (SVI). If there are access ports in VLAN 5, for example, this issue will be observed only if interface vlan 5 is not configured. To mitigate this issue for vulnerable releases of Cisco IOS Software, administrators can ensure that each VLAN assigned to access ports has a corresponding SVI configured.\r\n\r\nFor Cisco IOS XE Software on switches, Dynamic ARP Inspection is affected on all releases. Administrators can configure static ARP entries for the default gateways and critical servers and hosts off the segments that are being protected to protect the critical assets in the environment.\r\n\r\nCisco IOS XE Software \u2013 Routers\r\n\r\nFor configurations that have a service instance with encapsulation priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can either add the keyword exact after the encapsulation priority-tagged or filter on the ethertype field with encapsulation priority-tagged etype ipv4 , ipv6.\r\n\r\nFor environments that do not have encapsulation priority-tagged assigned to a service instance, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure a service instance that is not assigned to a bridge domain with encapsulation priority-tagged.\r\n\r\nCisco IOS XR Software\r\n\r\nFor configurations that have an l2transport sub interface configured with encapsulation dot1q|dot1ad priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can add the keyword exact after the encapsulation dot1q|dot1ad priority-tagged.\r\n\r\nFor environments that do not have encapsulation dot1q|dot1ad priority-tagged assigned to an l2transport sub interface, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure l2transport sub interfaces that are not assigned to a bridge domain with encapsulation dot1q priority-tagged and encapsulation dot1ad priority-tagged.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\nmac access-list drop_three_tags\r\n deny any any 0x8100\r\n deny any any 0x88a8\r\n permit any any\r\n!\r\ninterface ethernet 1/4\r\n mac port access-group drop_three_tags\r\n!\r\n\r\n\r\nCisco Small Business Switches\r\n\r\nTo ensure that FHS works correctly on access ports, install a MAC ACL to deny only tagged frames (because they are not to be expected on an access port) or to permit only ARP, IPv4, and IPv6 on all access ports. The following is an example from the Cisco Sx250, 350, and 550 Series Smart Switches and the Cisco Business 250 and 350 Series Smart Switches:\r\n\r\n\r\nmac access-list extended arp-ip-ip6\r\npermit any any 806 0000 ace-priority 1\r\npermit any any 800 0000 ace-priority 2\r\npermit any any 86dd 0000 ace-priority 3\r\n\r\n\r\n      CVE-2021-27861\r\nThe principle for mitigating CVE-2021-27861 is to drop any packets that cannot have their Layer 3 protocol detected using a Layer 2 ACL.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHP has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco IOS XR Software\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\ninterface Ethernet1/3\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy HOSTS\r\n!\r\ninterface Ethernet1/4\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy CSCvw92154\r\n!\r\nmac access-list drop_non\r\n  10 permit any any 0x86dd\r\n  20 permit any any ip\r\n  30 permit any any 0x806\r\n  35 permit any 0100.0ccc.cccc 0000.0000.0000\r\n  40 deny any any\r\n!\r\n\r\nCisco Small Business Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nWhile these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.",
          "product_ids": [
            "CSAFPID-190024"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-190024"
          ]
        }
      ],
      "title": "VU855201: 802.3/802.11 frame conversion can bypass First Hop Security Affecting Cisco Products"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "summary": "Cisco would like to thank Etienne Champetier for reporting these vulnerabilities and Cert/CC for the coordination."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "On September 27, 2022, the following vulnerabilities affecting Cisco products were disclosed by Cert/CC as part of VU855201, titled  L2 network security controls can be bypassed using VLAN 0 stacking and/or 802.3 headers [\"https://kb.cert.org/vuls/id/855201\"]:\r\n\r\nCVE-2021-27853: Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using a combination of VLAN 0 headers and LLC/SNAP headers.\r\nCVE-2021-27854: Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using a combination of VLAN 0 headers, LLC/SNAP headers in Ethernet to Wifi frame translation, and in the reverse\u2014Wifi to Ethernet.\r\nCVE-2021-27861: Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers).\r\nCVE-2021-27862: Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (and optionally VLAN0 headers).\r\n\r\nExploitation of these vulnerabilities could allow an adjacent attacker to bypass configured first-hop security (FHS) features on the affected Cisco products.\r\n\r\nFor more information about these vulnerabilities, see the Details [\"#details\"] section of this advisory.\r\n\r\nThis advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX [\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX\"]",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "The Vulnerable Products [\"#vp\"] section includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool [\"https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID\"] and will contain additional platform-specific information, including workarounds (if available) and fixed software releases (if available).\r\n\r\nAny product or service not listed in the Vulnerable Products [\"#vp\"] section of this advisory is to be considered not vulnerable.",
        "title": "Affected Products"
      },
      {
        "category": "general",
        "text": "CVE-2021-27853\r\nThe following table lists Cisco products that are affected by the vulnerability that is described in CVE-2021-27853. See the Details [\"#details\"] section of this advisory for more information about affected configurations.\r\n\r\nNote: End of life products have not been evaluated.\r\n        Cisco Product  Cisco Bug ID  Additional Information      Cisco IOS Software - Switches      Catalyst 6500 and 6800 Series Switches  CSCwa06145 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa06145\"]  Fixed software will not be made available.      Catalyst Digital Building Series Switches  CSCwa14942 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14942\"]  Fixed software will not be made available.      Industrial Ethernet Switches  CSCvw99743 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw99743\"]  Fixed software will not be made available.      Micro Switches  CSCwa14271 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14271\"]  Fixed software will not be made available.      Cisco IOS XE Software - Switches       Catalyst 4500 IOS-XE Switches  CSCwa18093 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa18093\"]  Fixed software will not be made available.      IOS XE Switches  CSCvz91291 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz91291\"]\r\nCSCwb01481 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwb01481\"]  CSCvz91291 affects Cisco IOS XE Software releases 17.6.1 and later. A fix is available for all FHS features except Dynamic ARP inspection.\r\n\r\nCSCwb01481 is relevant for Dynamic ARP Inspection and impacts all releases. Fixed Software will not be made available.      Cisco IOS XE Software - Routers      IOS XE Routers configured with Ethernet virtual circuits  CSCvz96133 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz96133\"]  Fixed software will not be made available.      Cisco IOS XR Software      IOS XR Routers configured with L2 Transport services  CSCvz88705 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz88705\"]\r\nCSCvz89602 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz89602\"]  Fixed software will not be made available.      Cisco Meraki - Switches      MS390  N/A  Impact is only for Dynamic ARP Inspection. Fixed software will not be made available.      MS210\r\nMS225\r\nMS250\r\nMS350\r\nMS355\r\nMS410\r\nMS420\r\nMS425\r\nMS450  N/A  Fixed software will not be made available.      Cisco NX-OS Software      Nexus 3000 Series Switches  CSCvx33758 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx33758\"]  Fixed software will not be made available.      Nexus 5500 Platform Switches\r\nNexus 5600 Platform Switches\r\nNexus 6000 Series Switches  CSCvx35087 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx35087\"]  Fixed software will not be made available.      Nexus 7000 Series Switches  CSCvx35085 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx35085\"]  Fixed software will not be made available.      Nexus 9000 Series Switches (Standalone Mode)  CSCvx33758 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx33758\"]  Fixed software will not be made available.      Cisco Small Business Switches      250 Series Smart Switches\r\n350 Series Managed Switches\r\n350X Series Stackable Managed Switches\r\n550X Series Stackable Managed Switches\r\nBusiness 250 Series Smart Switches\r\nBusiness 350 Series Managed Switches  CSCvw92154 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw92154\"]  Fixed software will not be made available.        CVE-2021-27854\r\nCisco Access Points\r\n\r\nCisco evaluated this vulnerability based on its impact on FHS features that are configured on Cisco Access Points. No impact was observed.\r\n\r\nAs part of the investigation into the impact to Cisco Access Points, another vulnerability was found, and a companion advisory has been published: Cisco Access Points VLAN Bypass from Native VLAN Vulnerability [\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apvlan-TDTtb4FY\"].\r\n  CVE-2021-27861\r\nThe following table lists Cisco products that are affected by the vulnerability that is described in CVE-2021-27861. See the Details [\"#details\"] section of this advisory for more information about affected configurations.\r\n\r\nNote: End of life products have not been evaluated.\r\n        Cisco Product  Cisco Bug ID  Additional Information      Cisco IOS Software - Switches      Catalyst 6500 and 6800 Series Switches  CSCwa06265 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa06265\"]  Fixed software will not be made available.      Catalyst Digital Building Series Switches  CSCwa14950 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14950\"]  Fixed software will not be made available.      Micro Switches  CSCwa14282 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14282\"]  Fixed software will not be made available.      Cisco IOS XR Software      IOS XR Routers configured with L2 Transport services  CSCwa04809 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa04809\"]  Fixed software will not be made available.      Cisco Meraki - Switches      MS210\r\nMS225\r\nMS250\r\nMS350\r\nMS355\r\nMS410\r\nMS420\r\nMS425\r\nMS450  N/A  Fixed software will not be made available.      Cisco NX-OS Software      Nexus 3000 Series Switches  CSCwa01097 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa01097\"]  Fixed software will not be made available.      Nexus 5500 Platform Switches\r\nNexus 5600 Platform Switches\r\nNexus 6000 Series Switches  CSCwa18209 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa18209\"]  Fixed software will not be made available.      Nexus 7000 Series Switches  CSCwa18310 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa18310\"]  Fixed software will not be made available.      Nexus 9000 Series Switches (Standalone Mode)  CSCwa01097 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa01097\"]  Fixed software will not be made available.      Cisco Small Business Switches      250 Series Smart Switches\r\n350 Series Managed Switches\r\n350X Series Stackable Managed Switches\r\n550X Series Stackable Managed Switches\r\nBusiness 250 Series Smart Switches\r\nBusiness 350 Series Managed Switches  CSCwa09081 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa09081\"]  Fixed software will not be made available.        CVE-2021-27862\r\nCisco evaluated this vulnerability based on its impact on FHS features that are configured on Cisco Access points. No impact was observed.",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.\r\n  CVE-2021-27853\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nONT Switches\r\n\r\nCatalyst PON Series Switches\r\n\r\nIOS Switches\r\n\r\nCatalyst 1000 Series Switches\r\n\r\nIOS XE Platforms\r\n\r\nCatalyst 8000 Series Edge Platforms\r\n\r\nNX-OS Software\r\n\r\n\r\nMDS 9000 Series Multilayer Switches\r\nNexus 1000V Series Switches\r\nNexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode\r\nUCS 6x00 Series Fabric Interconnects\r\n\r\nMeraki Switches\r\n\r\nGS110 Switches\r\nMS22 Switches\r\nMS42 Switches\r\nMS120 Switches\r\nMS125 Switches\r\nMS220 Switches\r\nMS320 Switches\r\n  CVE-2021-27854\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nAccess Points\r\nAireOS Access Points\r\nMeraki Access Points\r\n  CVE-2021-27861\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nONT Switches\r\n\r\nCatalyst PON Series Switches\r\n\r\nIOS Switches\r\n\r\nCatalyst 1000 Series Switches\r\nIndustrial Ethernet Switches\r\n\r\nIOS XE Routers\r\n\r\nIOS XE Routers when configured with Ethernet virtual circuits\r\n\r\nIOS XE Software Switches\r\n\r\nCatalyst 3650 Series Switches\r\nCatalyst 3850 Series Switches\r\nCatalyst 4500E and 4500X Series Switches\r\nCatalyst 9000 Series Switches\r\n\r\nMeraki Switches\r\n\r\nGS110 Switches\r\nMS22 Switches\r\nMS42 Switches\r\nMS120 Switches\r\nMS125 Switches\r\nMS220 Switches\r\nMS320 Switches\r\nMS390 Switches\r\n\r\nNX-OS Software\r\n\r\n\r\nMDS 9000 Series Multilayer Switches\r\nNexus 1000V Series Switches\r\nNexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode\r\nUCS 6x00 Series Fabric Interconnects\r\n  CVE-2021-27862\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nAccess Points\r\nAireOS Access Points\r\nMeraki Access Points",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit another vulnerability. In addition, a software release that is affected by one of the vulnerabilities may not be affected by the other vulnerabilities.\r\n  CVE-2021-27853\r\nA vulnerability in the processing of stacked Ethernet tag headers of multiple Cisco products could allow an unauthenticated, adjacent attacker to bypass the FHS feature of an affected device.\r\n\r\nThis vulnerability is due to the platforms forwarding frames when the upper-layer protocol cannot be determined to invoke a Layer 3 FHS feature. An attacker could exploit this vulnerability by sending packets with stacked VLAN Ethernet headers. A successful exploit could allow the attacker to bypass the FHS feature of an affected device.\r\n\r\nCisco has not released software updates that address this vulnerability. There are workarounds that address this vulnerability.\r\n\r\nCVE ID: CVE-2021-27853\r\nSecurity Impact Rating (SIR): Medium\r\nCVSS Base Score: 4.7\r\nCVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N\r\n\r\nCVE-2021-27853: Additional Details\r\n\r\nThe IEEE Std 802.1Q-2018 standard incorporates a priority-tagged frame whose tag header carries priority information but no VLAN identification information. The VLAN identifier is set to 0 and is typically carried in a single 802.1Q header between the source MAC address and the Ethertype/size field.\r\n\r\nIn networks where VLAN tagging is used, there is typically a single 802.1Q header between the source MAC address and the Ethertype/size field. IEEE 802.1AD has double tagging and includes the S-TAG and C-TAG headers between the source MAC address and the Ethertype/size field.\r\n\r\nThe IEEE Std 802.1Q-2018 does not specify that there should be no more than two tags present, but Cisco products have a limit on how many tags can be inspected to establish the upper-layer protocols (determined by the Ethertype field), whether a packet is classified as IPv4 or IPv6, and whether it is subject to additional Layer 3 feature processing. If these things cannot be determined, the packet is forwarded based on the Layer 2 information, depending on the device configuration.\r\n\r\nDepending on the implementation of the next device that receives the frame, the frame may be dropped as invalid or the priority tags may be removed and processed. These actions are dependent on the implementation of the receiving host operating system.\r\n  CVE-2021-27853: Cisco Network Operating Systems\r\nThis section provides specific details about how the different affected Cisco network operating systems handle Ethernet frames with a VLAN ID 0 tag.\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nBy default, all of the affected Cisco IOS Switches process inbound packets with the frame header that contains a VLAN ID 0 tag. Cisco products have a limit on how many tags can be inspected to establish the upper-layer protocols.\r\n\r\nNote: Cisco IOS Switches that have reached end of life have not been evaluated by the Cisco Product Security Incident Response Team (PSIRT).\r\n\r\nCisco IOS XE Software \u2013 Switches\r\n\r\nBy default, Cisco Catalyst 4500E Series switches process an inbound packet with the frame header that contains a VLAN ID 0 tag. Cisco products have a limit on how many tags can be inspected to establish the upper-layer protocols.\r\n\r\nThe default behavior of a Cisco IOS XE Switch is to drop all traffic that has a frame header that contains a VLAN ID 0 tag. The switch only processes frames with a VLAN ID 0 tag if the access port is configured as follows:\r\n\r\n\r\nswitchport voice vlan dot1p\r\n\r\nCisco IOS XE Software \u2013 Routers\r\n\r\nCisco IOS XE devices that are configured with service instances handle the VLAN ID 0 tag in accordance with their configurations. For VLAN-based services, the top one or two tags are inspected based on configuration and map to the appropriate service instance on the longest match rules.\r\n\r\nService instance-based configurations that contain encapsulation dot1q priority-tagged, encapsulation dot1q priority-tagged exact, or encapsulation default are affected by this vulnerability.\r\n\r\nThe order of matching a service instance for VLAN ID 0 is based on encapsulation dot1q priority-tagged first and then encapsulation default. Cisco IOS XE Software does not match on encapsulation dot1q any for VLAN ID 0 tags.\r\n\r\nCisco IOS XR Software\r\n\r\nCisco IOS XR Software running on Layer 2 Transport interfaces handles a VLAN ID 0 tag in accordance with the configurations applied to the device. For port-based services, the packets are forwarded with no inspection. For VLAN-based services, either the top tag or the top two tags are inspected based on configuration and map to the appropriate attachment circuit based on the longest match rules. Fore more information, see IOS XR L2VPN Services and Features [\"https://www.cisco.com/c/en/us/support/docs/routers/asr-9000-series-aggregation-services-routers/116453-technote-ios-xr-l2vpn-00.html#anc6\"].\r\n\r\nConfigurations that contain encapsulation dot1q priority-tagged, encapsulation dot1q priority-tagged exact, or encapsulation default on Layer 2 Transport VLAN-based configurations are affected by this vulnerability.\r\n\r\nCisco NX-OS Software\r\n\r\nBy default, Cisco NX-OS Software processes an inbound packet with the frame header containing a VLAN ID 0 tag. The initial VLAN ID 0 tag is stripped and then processed in accordance with the rest of the packet contents. Cisco products have a limit on how many tags can be inspected to establish the upper-layer protocols.\r\n\r\nCisco Small Business Switches\r\n\r\nBy default, Cisco Small Business Switches process an inbound packet with the frame header that contains a VLAN ID 0 tag. Cisco products have a limit on how many tags can be inspected to establish the upper-layer protocols.\r\n    CVE-2021-27854\r\nCVE-2021-27854 examines the way frames are converted between 802.11 and 802.3 with the injection of VLAN tags in the SNAP headers.\r\n\r\nCisco evaluated this vulnerability for any impact to the security features on wireless access points when handling these frame conversions. Cisco found that no configured FHS features were bypassed.\r\n\r\nCVE ID: CVE-2021-27854\r\nSecurity Impact Rating (SIR): Medium\r\nCVSS Base Score: 4.7\r\nCVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N\r\n    CVE-2021-27861\r\nA vulnerability in the Ethernet processing of multiple Cisco products could allow an unauthenticated, adjacent attacker to bypass the FHS feature of an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of SNAP/LLC Ethernet frames. An attacker could exploit this vulnerability by sending packets with a crafted (or not crafted, depending on the product) SNAP/LLC Ethernet header. A successful exploit could allow the attacker to bypass the FHS feature of an affected device.\r\n\r\nCisco has not released software updates that address this vulnerability. There are workarounds that address this vulnerability for some products.\r\n\r\nCVE ID: CVE-2021-27861\r\nSecurity Impact Rating (SIR): Medium\r\nCVSS Base Score: 4.7\r\nCVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N\r\n  CVE-2021-27861: Cisco Network Operating Systems\r\nThis section provides specific details about how the different affected Cisco network operating systems handle SNAP/LLC Ethernet frames.\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nThe affected Cisco IOS Software products forward SNAP/LLC frames without additional FHS feature inspection.\r\n\r\nCisco IOS XR Software\r\n\r\nThe affected Cisco IOS XR Software products forward SNAP/LLC frames without additional FHS feature inspection.\r\n\r\nCisco NX-OS Software\r\n\r\nThe affected Cisco NX-OS Software products forward SNAP/LLC frames without any additional FHS feature inspection.\r\n\r\nCisco Small Business Switches\r\n\r\nThe affected Cisco Small Business Switches correctly apply FHS features for SNAP/LLC frames with a length field of up to 1,500. However, SNAP/LLC frames with lengths of 1,501 through 1,535 are forwarded without additional FHS feature inspection.\r\n    CVE-2021-27862\r\nCVE-2021-27862 examines the way frames are converted between 802.3 to 802.11 and the length field.\r\n\r\nCisco evaluated this vulnerability for any impact to the security features on wireless access points when handling these frame conversions. Cisco found that no configured FHS features were bypassed.\r\n\r\nCVE ID: CVE-2021-27862\r\nSecurity Impact Rating (SIR): Medium\r\nCVSS Base Score: 4.7\r\nCVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
        "title": "Details"
      },
      {
        "category": "general",
        "text": "There are workarounds that address some of these vulnerabilities.\r\n    CVE-2021-27853\r\nAdministrators may drop packets that cannot have their ethertype detected using a Layer 2 access control list (ACL) or where tags are not expected to drop tagged traffic. If a single dot1P header is received, it will still be processed correctly if the network operating system supports it.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHS has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\n\r\n!\r\nmac access-list extended CSCwa14271\r\n permit any any 0x86DD 0x0\r\n permit any any 0x800 0x0\r\n permit any any 0x806 0x0\r\n deny   any any\r\n!\r\ninterface GigabitEthernet1/0/1\r\n switchport access vlan 5\r\n switchport voice vlan dot1p\r\n ipv6 nd raguard attach-policy HOSTS\r\n mac access-group CSCwa14271 in\r\n!\r\n\r\nCisco IOS XE Software \u2013 Switches\r\n\r\nFor Cisco IOS XE Software on switches, impact to all FHS features occurs on Cisco IOS Software releases 17.6.1 and later, but earlier than the first fixed release. The issue will not be seen if the access port VLAN also has an active switched virtual interface (SVI). If there are access ports in VLAN 5, for example, this issue will be observed only if interface vlan 5 is not configured. To mitigate this issue for vulnerable releases of Cisco IOS Software, administrators can ensure that each VLAN assigned to access ports has a corresponding SVI configured.\r\n\r\nFor Cisco IOS XE Software on switches, Dynamic ARP Inspection is affected on all releases. Administrators can configure static ARP entries for the default gateways and critical servers and hosts off the segments that are being protected to protect the critical assets in the environment.\r\n\r\nCisco IOS XE Software \u2013 Routers\r\n\r\nFor configurations that have a service instance with encapsulation priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can either add the keyword exact after the encapsulation priority-tagged or filter on the ethertype field with encapsulation priority-tagged etype ipv4 , ipv6.\r\n\r\nFor environments that do not have encapsulation priority-tagged assigned to a service instance, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure a service instance that is not assigned to a bridge domain with encapsulation priority-tagged.\r\n\r\nCisco IOS XR Software\r\n\r\nFor configurations that have an l2transport sub interface configured with encapsulation dot1q|dot1ad priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can add the keyword exact after the encapsulation dot1q|dot1ad priority-tagged.\r\n\r\nFor environments that do not have encapsulation dot1q|dot1ad priority-tagged assigned to an l2transport sub interface, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure l2transport sub interfaces that are not assigned to a bridge domain with encapsulation dot1q priority-tagged and encapsulation dot1ad priority-tagged.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\nmac access-list drop_three_tags\r\n deny any any 0x8100\r\n deny any any 0x88a8\r\n permit any any\r\n!\r\ninterface ethernet 1/4\r\n mac port access-group drop_three_tags\r\n!\r\n\r\n\r\nCisco Small Business Switches\r\n\r\nTo ensure that FHS works correctly on access ports, install a MAC ACL to deny only tagged frames (because they are not to be expected on an access port) or to permit only ARP, IPv4, and IPv6 on all access ports. The following is an example from the Cisco Sx250, 350, and 550 Series Smart Switches and the Cisco Business 250 and 350 Series Smart Switches:\r\n\r\n\r\nmac access-list extended arp-ip-ip6\r\npermit any any 806 0000 ace-priority 1\r\npermit any any 800 0000 ace-priority 2\r\npermit any any 86dd 0000 ace-priority 3\r\n\r\n\r\n      CVE-2021-27861\r\nThe principle for mitigating CVE-2021-27861 is to drop any packets that cannot have their Layer 3 protocol detected using a Layer 2 ACL.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHP has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco IOS XR Software\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\ninterface Ethernet1/3\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy HOSTS\r\n!\r\ninterface Ethernet1/4\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy CSCvw92154\r\n!\r\nmac access-list drop_non\r\n  10 permit any any 0x86dd\r\n  20 permit any any ip\r\n  30 permit any any 0x806\r\n  35 permit any 0100.0ccc.cccc 0000.0000.0000\r\n  40 deny any any\r\n!\r\n\r\nCisco Small Business Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nWhile these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "When considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.\r\n    Fixed Releases    CVE-2021-27853\r\nAt the time of publication, the release information in the following table was accurate. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.\r\n        Product  Cisco Bug ID  First Fixed Release          Cisco IOS XE Switches  CSCvz91291 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz91291\"]  17.6.3\r\n17.8.1            CVE-2021-27854\r\nCisco evaluated this vulnerability based on its impact on FHS features configured on the access points. No impact was observed.\r\n      CVE-2021-27861\r\nAt the time of publication, Cisco had not released updates that address this vulnerability for any Cisco product.\r\n      CVE-2021-27862\r\nCisco evaluated this vulnerability based on its impact on FHS features configured on the access points. No impact was observed.\r\n\r\nThe Cisco PSIRT validates only the affected and fixed release information that is documented in this advisory.",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "Cisco would like to thank Etienne Champetier for reporting these vulnerabilities and Cert/CC for the coordination.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "Emergency Support:\r\n+1 877 228 7302 (toll-free within North America)\r\n+1 408 525 6532 (International direct-dial)\r\nNon-emergency Support:\r\nEmail: psirt@cisco.com\r\nSupport requests that are received via e-mail are typically acknowledged within 48 hours.",
      "issuing_authority": "Cisco product security incident response is the responsibility of the Cisco Product Security Incident Response Team (PSIRT). The Cisco PSIRT is a dedicated, global team that manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks. The on-call Cisco PSIRT works 24x7 with Cisco customers, independent security researchers, consultants, industry organizations, and other vendors to identify possible security issues with Cisco products and networks.\r\nMore information can be found in Cisco Security Vulnerability Policy available at https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerabilities in Layer 2 Network Security Controls Affecting Cisco Products: September 2022",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "L2 network security controls can be bypassed using VLAN 0 stacking and/or 802.3 headers",
        "url": "https://kb.cert.org/vuls/id/855201"
      },
      {
        "category": "external",
        "summary": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX"
      },
      {
        "category": "external",
        "summary": "Cisco\u0026nbsp;Bug Search Tool",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID"
      },
      {
        "category": "external",
        "summary": "CSCwa06145",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa06145"
      },
      {
        "category": "external",
        "summary": "CSCwa14942",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14942"
      },
      {
        "category": "external",
        "summary": "CSCvw99743",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw99743"
      },
      {
        "category": "external",
        "summary": "CSCwa14271",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14271"
      },
      {
        "category": "external",
        "summary": "CSCwa18093",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa18093"
      },
      {
        "category": "external",
        "summary": "CSCvz91291",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz91291"
      },
      {
        "category": "external",
        "summary": "CSCwb01481",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwb01481"
      },
      {
        "category": "external",
        "summary": "CSCvz96133",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz96133"
      },
      {
        "category": "external",
        "summary": "CSCvz88705",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz88705"
      },
      {
        "category": "external",
        "summary": "CSCvz89602",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz89602"
      },
      {
        "category": "external",
        "summary": "CSCvx33758",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx33758"
      },
      {
        "category": "external",
        "summary": "CSCvx35087",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx35087"
      },
      {
        "category": "external",
        "summary": "CSCvx35085",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx35085"
      },
      {
        "category": "external",
        "summary": "CSCvx33758",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx33758"
      },
      {
        "category": "external",
        "summary": "CSCvw92154",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw92154"
      },
      {
        "category": "external",
        "summary": "Cisco\u0026nbsp;Access Points VLAN Bypass from Native VLAN Vulnerability",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apvlan-TDTtb4FY"
      },
      {
        "category": "external",
        "summary": "CSCwa06265",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa06265"
      },
      {
        "category": "external",
        "summary": "CSCwa14950",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14950"
      },
      {
        "category": "external",
        "summary": "CSCwa14282",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14282"
      },
      {
        "category": "external",
        "summary": "CSCwa04809",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa04809"
      },
      {
        "category": "external",
        "summary": "CSCwa01097",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa01097"
      },
      {
        "category": "external",
        "summary": "CSCwa18209",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa18209"
      },
      {
        "category": "external",
        "summary": "CSCwa18310",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa18310"
      },
      {
        "category": "external",
        "summary": "CSCwa01097",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa01097"
      },
      {
        "category": "external",
        "summary": "CSCwa09081",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa09081"
      },
      {
        "category": "external",
        "summary": "IOS XR L2VPN Services and Features",
        "url": "https://www.cisco.com/c/en/us/support/docs/routers/asr-9000-series-aggregation-services-routers/116453-technote-ios-xr-l2vpn-00.html#anc6"
      },
      {
        "category": "external",
        "summary": "considering software upgrades",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "Cisco\u0026nbsp;Security Advisories page",
        "url": "https://www.cisco.com/go/psirt"
      },
      {
        "category": "external",
        "summary": "CSCvz91291",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz91291"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      }
    ],
    "title": "Vulnerabilities in Layer 2 Network Security Controls Affecting Cisco Products: September 2022",
    "tracking": {
      "current_release_date": "2022-10-05T18:16:08+00:00",
      "generator": {
        "date": "2022-10-22T03:15:47+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-VU855201-J3z8CKTX",
      "initial_release_date": "2022-09-27T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2022-09-27T16:38:06+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        },
        {
          "date": "2022-10-05T18:16:08+00:00",
          "number": "1.1.0",
          "summary": "Corrected affected product information."
        }
      ],
      "status": "final",
      "version": "1.1.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "IOS",
            "product": {
              "name": "Cisco IOS ",
              "product_id": "CSAFPID-2097"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco IOS XR Software",
            "product": {
              "name": "Cisco IOS XR Software ",
              "product_id": "CSAFPID-5834"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco NX-OS Software",
            "product": {
              "name": "Cisco NX-OS Software ",
              "product_id": "CSAFPID-80720"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco IOS XE Software",
            "product": {
              "name": "Cisco IOS XE Software ",
              "product_id": "CSAFPID-93036"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Aironet Access Point Software",
            "product": {
              "name": "Cisco Aironet Access Point Software ",
              "product_id": "CSAFPID-190024"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Small Business Smart and Managed Switches",
            "product": {
              "name": "Cisco Small Business Smart and Managed Switches ",
              "product_id": "CSAFPID-278027"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-27862",
      "notes": [
        {
          "category": "other",
          "text": "Not available.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "remediations": [
        {
          "category": "workaround",
          "details": "There are workarounds that address some of these vulnerabilities.\r\n    CVE-2021-27853\r\nAdministrators may drop packets that cannot have their ethertype detected using a Layer 2 access control list (ACL) or where tags are not expected to drop tagged traffic. If a single dot1P header is received, it will still be processed correctly if the network operating system supports it.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHS has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\n\r\n!\r\nmac access-list extended CSCwa14271\r\n permit any any 0x86DD 0x0\r\n permit any any 0x800 0x0\r\n permit any any 0x806 0x0\r\n deny   any any\r\n!\r\ninterface GigabitEthernet1/0/1\r\n switchport access vlan 5\r\n switchport voice vlan dot1p\r\n ipv6 nd raguard attach-policy HOSTS\r\n mac access-group CSCwa14271 in\r\n!\r\n\r\nCisco IOS XE Software \u2013 Switches\r\n\r\nFor Cisco IOS XE Software on switches, impact to all FHS features occurs on Cisco IOS Software releases 17.6.1 and later, but earlier than the first fixed release. The issue will not be seen if the access port VLAN also has an active switched virtual interface (SVI). If there are access ports in VLAN 5, for example, this issue will be observed only if interface vlan 5 is not configured. To mitigate this issue for vulnerable releases of Cisco IOS Software, administrators can ensure that each VLAN assigned to access ports has a corresponding SVI configured.\r\n\r\nFor Cisco IOS XE Software on switches, Dynamic ARP Inspection is affected on all releases. Administrators can configure static ARP entries for the default gateways and critical servers and hosts off the segments that are being protected to protect the critical assets in the environment.\r\n\r\nCisco IOS XE Software \u2013 Routers\r\n\r\nFor configurations that have a service instance with encapsulation priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can either add the keyword exact after the encapsulation priority-tagged or filter on the ethertype field with encapsulation priority-tagged etype ipv4 , ipv6.\r\n\r\nFor environments that do not have encapsulation priority-tagged assigned to a service instance, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure a service instance that is not assigned to a bridge domain with encapsulation priority-tagged.\r\n\r\nCisco IOS XR Software\r\n\r\nFor configurations that have an l2transport sub interface configured with encapsulation dot1q|dot1ad priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can add the keyword exact after the encapsulation dot1q|dot1ad priority-tagged.\r\n\r\nFor environments that do not have encapsulation dot1q|dot1ad priority-tagged assigned to an l2transport sub interface, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure l2transport sub interfaces that are not assigned to a bridge domain with encapsulation dot1q priority-tagged and encapsulation dot1ad priority-tagged.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\nmac access-list drop_three_tags\r\n deny any any 0x8100\r\n deny any any 0x88a8\r\n permit any any\r\n!\r\ninterface ethernet 1/4\r\n mac port access-group drop_three_tags\r\n!\r\n\r\n\r\nCisco Small Business Switches\r\n\r\nTo ensure that FHS works correctly on access ports, install a MAC ACL to deny only tagged frames (because they are not to be expected on an access port) or to permit only ARP, IPv4, and IPv6 on all access ports. The following is an example from the Cisco Sx250, 350, and 550 Series Smart Switches and the Cisco Business 250 and 350 Series Smart Switches:\r\n\r\n\r\nmac access-list extended arp-ip-ip6\r\npermit any any 806 0000 ace-priority 1\r\npermit any any 800 0000 ace-priority 2\r\npermit any any 86dd 0000 ace-priority 3\r\n\r\n\r\n      CVE-2021-27861\r\nThe principle for mitigating CVE-2021-27861 is to drop any packets that cannot have their Layer 3 protocol detected using a Layer 2 ACL.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHP has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco IOS XR Software\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\ninterface Ethernet1/3\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy HOSTS\r\n!\r\ninterface Ethernet1/4\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy CSCvw92154\r\n!\r\nmac access-list drop_non\r\n  10 permit any any 0x86dd\r\n  20 permit any any ip\r\n  30 permit any any 0x806\r\n  35 permit any 0100.0ccc.cccc 0000.0000.0000\r\n  40 deny any any\r\n!\r\n\r\nCisco Small Business Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nWhile these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment."
        }
      ],
      "title": "VU855201: When converting from 802.3 (LLC/SNAP) to 802.11, Linux ignore the length field. "
    },
    {
      "cve": "CVE-2021-27853",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvz96133"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa18093"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvz91291"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwb01481"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa14271"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa06145"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa14942"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvw99743"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvx33758"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvx35087"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvx35085"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvz89602"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvz88705"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvw92154"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-93036",
          "CSAFPID-2097",
          "CSAFPID-80720",
          "CSAFPID-5834",
          "CSAFPID-278027"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-93036",
            "CSAFPID-80720",
            "CSAFPID-278027",
            "CSAFPID-2097",
            "CSAFPID-5834"
          ],
          "url": "https://software.cisco.com"
        },
        {
          "category": "workaround",
          "details": "There are workarounds that address some of these vulnerabilities.\r\n    CVE-2021-27853\r\nAdministrators may drop packets that cannot have their ethertype detected using a Layer 2 access control list (ACL) or where tags are not expected to drop tagged traffic. If a single dot1P header is received, it will still be processed correctly if the network operating system supports it.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHS has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\n\r\n!\r\nmac access-list extended CSCwa14271\r\n permit any any 0x86DD 0x0\r\n permit any any 0x800 0x0\r\n permit any any 0x806 0x0\r\n deny   any any\r\n!\r\ninterface GigabitEthernet1/0/1\r\n switchport access vlan 5\r\n switchport voice vlan dot1p\r\n ipv6 nd raguard attach-policy HOSTS\r\n mac access-group CSCwa14271 in\r\n!\r\n\r\nCisco IOS XE Software \u2013 Switches\r\n\r\nFor Cisco IOS XE Software on switches, impact to all FHS features occurs on Cisco IOS Software releases 17.6.1 and later, but earlier than the first fixed release. The issue will not be seen if the access port VLAN also has an active switched virtual interface (SVI). If there are access ports in VLAN 5, for example, this issue will be observed only if interface vlan 5 is not configured. To mitigate this issue for vulnerable releases of Cisco IOS Software, administrators can ensure that each VLAN assigned to access ports has a corresponding SVI configured.\r\n\r\nFor Cisco IOS XE Software on switches, Dynamic ARP Inspection is affected on all releases. Administrators can configure static ARP entries for the default gateways and critical servers and hosts off the segments that are being protected to protect the critical assets in the environment.\r\n\r\nCisco IOS XE Software \u2013 Routers\r\n\r\nFor configurations that have a service instance with encapsulation priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can either add the keyword exact after the encapsulation priority-tagged or filter on the ethertype field with encapsulation priority-tagged etype ipv4 , ipv6.\r\n\r\nFor environments that do not have encapsulation priority-tagged assigned to a service instance, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure a service instance that is not assigned to a bridge domain with encapsulation priority-tagged.\r\n\r\nCisco IOS XR Software\r\n\r\nFor configurations that have an l2transport sub interface configured with encapsulation dot1q|dot1ad priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can add the keyword exact after the encapsulation dot1q|dot1ad priority-tagged.\r\n\r\nFor environments that do not have encapsulation dot1q|dot1ad priority-tagged assigned to an l2transport sub interface, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure l2transport sub interfaces that are not assigned to a bridge domain with encapsulation dot1q priority-tagged and encapsulation dot1ad priority-tagged.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\nmac access-list drop_three_tags\r\n deny any any 0x8100\r\n deny any any 0x88a8\r\n permit any any\r\n!\r\ninterface ethernet 1/4\r\n mac port access-group drop_three_tags\r\n!\r\n\r\n\r\nCisco Small Business Switches\r\n\r\nTo ensure that FHS works correctly on access ports, install a MAC ACL to deny only tagged frames (because they are not to be expected on an access port) or to permit only ARP, IPv4, and IPv6 on all access ports. The following is an example from the Cisco Sx250, 350, and 550 Series Smart Switches and the Cisco Business 250 and 350 Series Smart Switches:\r\n\r\n\r\nmac access-list extended arp-ip-ip6\r\npermit any any 806 0000 ace-priority 1\r\npermit any any 800 0000 ace-priority 2\r\npermit any any 86dd 0000 ace-priority 3\r\n\r\n\r\n      CVE-2021-27861\r\nThe principle for mitigating CVE-2021-27861 is to drop any packets that cannot have their Layer 3 protocol detected using a Layer 2 ACL.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHP has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco IOS XR Software\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\ninterface Ethernet1/3\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy HOSTS\r\n!\r\ninterface Ethernet1/4\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy CSCvw92154\r\n!\r\nmac access-list drop_non\r\n  10 permit any any 0x86dd\r\n  20 permit any any ip\r\n  30 permit any any 0x806\r\n  35 permit any 0100.0ccc.cccc 0000.0000.0000\r\n  40 deny any any\r\n!\r\n\r\nCisco Small Business Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nWhile these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.",
          "product_ids": [
            "CSAFPID-93036",
            "CSAFPID-2097",
            "CSAFPID-80720",
            "CSAFPID-5834",
            "CSAFPID-278027"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-93036",
            "CSAFPID-2097",
            "CSAFPID-80720",
            "CSAFPID-5834",
            "CSAFPID-278027"
          ]
        }
      ],
      "title": "VU855201: 802.1Q VID0 Headers can bypass First Hop Security Affecting Cisco Products"
    },
    {
      "cve": "CVE-2021-27861",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa18209"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa01097"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa18310"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa14282"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa14950"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa06265"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa09081"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa04809"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-80720",
          "CSAFPID-2097",
          "CSAFPID-278027",
          "CSAFPID-5834"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-80720",
            "CSAFPID-278027",
            "CSAFPID-2097",
            "CSAFPID-5834"
          ],
          "url": "https://software.cisco.com"
        },
        {
          "category": "workaround",
          "details": "There are workarounds that address some of these vulnerabilities.\r\n    CVE-2021-27853\r\nAdministrators may drop packets that cannot have their ethertype detected using a Layer 2 access control list (ACL) or where tags are not expected to drop tagged traffic. If a single dot1P header is received, it will still be processed correctly if the network operating system supports it.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHS has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\n\r\n!\r\nmac access-list extended CSCwa14271\r\n permit any any 0x86DD 0x0\r\n permit any any 0x800 0x0\r\n permit any any 0x806 0x0\r\n deny   any any\r\n!\r\ninterface GigabitEthernet1/0/1\r\n switchport access vlan 5\r\n switchport voice vlan dot1p\r\n ipv6 nd raguard attach-policy HOSTS\r\n mac access-group CSCwa14271 in\r\n!\r\n\r\nCisco IOS XE Software \u2013 Switches\r\n\r\nFor Cisco IOS XE Software on switches, impact to all FHS features occurs on Cisco IOS Software releases 17.6.1 and later, but earlier than the first fixed release. The issue will not be seen if the access port VLAN also has an active switched virtual interface (SVI). If there are access ports in VLAN 5, for example, this issue will be observed only if interface vlan 5 is not configured. To mitigate this issue for vulnerable releases of Cisco IOS Software, administrators can ensure that each VLAN assigned to access ports has a corresponding SVI configured.\r\n\r\nFor Cisco IOS XE Software on switches, Dynamic ARP Inspection is affected on all releases. Administrators can configure static ARP entries for the default gateways and critical servers and hosts off the segments that are being protected to protect the critical assets in the environment.\r\n\r\nCisco IOS XE Software \u2013 Routers\r\n\r\nFor configurations that have a service instance with encapsulation priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can either add the keyword exact after the encapsulation priority-tagged or filter on the ethertype field with encapsulation priority-tagged etype ipv4 , ipv6.\r\n\r\nFor environments that do not have encapsulation priority-tagged assigned to a service instance, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure a service instance that is not assigned to a bridge domain with encapsulation priority-tagged.\r\n\r\nCisco IOS XR Software\r\n\r\nFor configurations that have an l2transport sub interface configured with encapsulation dot1q|dot1ad priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can add the keyword exact after the encapsulation dot1q|dot1ad priority-tagged.\r\n\r\nFor environments that do not have encapsulation dot1q|dot1ad priority-tagged assigned to an l2transport sub interface, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure l2transport sub interfaces that are not assigned to a bridge domain with encapsulation dot1q priority-tagged and encapsulation dot1ad priority-tagged.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\nmac access-list drop_three_tags\r\n deny any any 0x8100\r\n deny any any 0x88a8\r\n permit any any\r\n!\r\ninterface ethernet 1/4\r\n mac port access-group drop_three_tags\r\n!\r\n\r\n\r\nCisco Small Business Switches\r\n\r\nTo ensure that FHS works correctly on access ports, install a MAC ACL to deny only tagged frames (because they are not to be expected on an access port) or to permit only ARP, IPv4, and IPv6 on all access ports. The following is an example from the Cisco Sx250, 350, and 550 Series Smart Switches and the Cisco Business 250 and 350 Series Smart Switches:\r\n\r\n\r\nmac access-list extended arp-ip-ip6\r\npermit any any 806 0000 ace-priority 1\r\npermit any any 800 0000 ace-priority 2\r\npermit any any 86dd 0000 ace-priority 3\r\n\r\n\r\n      CVE-2021-27861\r\nThe principle for mitigating CVE-2021-27861 is to drop any packets that cannot have their Layer 3 protocol detected using a Layer 2 ACL.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHP has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco IOS XR Software\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\ninterface Ethernet1/3\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy HOSTS\r\n!\r\ninterface Ethernet1/4\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy CSCvw92154\r\n!\r\nmac access-list drop_non\r\n  10 permit any any 0x86dd\r\n  20 permit any any ip\r\n  30 permit any any 0x806\r\n  35 permit any 0100.0ccc.cccc 0000.0000.0000\r\n  40 deny any any\r\n!\r\n\r\nCisco Small Business Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nWhile these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.",
          "product_ids": [
            "CSAFPID-80720",
            "CSAFPID-2097",
            "CSAFPID-278027",
            "CSAFPID-5834"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-80720",
            "CSAFPID-2097",
            "CSAFPID-278027",
            "CSAFPID-5834"
          ]
        }
      ],
      "title": "VU855201: SNAP/LLC Headers can bypass First Hop Security Affecting Cisco Products"
    },
    {
      "cve": "CVE-2021-27854",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCvx37987"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-190024"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-190024"
          ],
          "url": "https://software.cisco.com"
        },
        {
          "category": "workaround",
          "details": "There are workarounds that address some of these vulnerabilities.\r\n    CVE-2021-27853\r\nAdministrators may drop packets that cannot have their ethertype detected using a Layer 2 access control list (ACL) or where tags are not expected to drop tagged traffic. If a single dot1P header is received, it will still be processed correctly if the network operating system supports it.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHS has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\n\r\n!\r\nmac access-list extended CSCwa14271\r\n permit any any 0x86DD 0x0\r\n permit any any 0x800 0x0\r\n permit any any 0x806 0x0\r\n deny   any any\r\n!\r\ninterface GigabitEthernet1/0/1\r\n switchport access vlan 5\r\n switchport voice vlan dot1p\r\n ipv6 nd raguard attach-policy HOSTS\r\n mac access-group CSCwa14271 in\r\n!\r\n\r\nCisco IOS XE Software \u2013 Switches\r\n\r\nFor Cisco IOS XE Software on switches, impact to all FHS features occurs on Cisco IOS Software releases 17.6.1 and later, but earlier than the first fixed release. The issue will not be seen if the access port VLAN also has an active switched virtual interface (SVI). If there are access ports in VLAN 5, for example, this issue will be observed only if interface vlan 5 is not configured. To mitigate this issue for vulnerable releases of Cisco IOS Software, administrators can ensure that each VLAN assigned to access ports has a corresponding SVI configured.\r\n\r\nFor Cisco IOS XE Software on switches, Dynamic ARP Inspection is affected on all releases. Administrators can configure static ARP entries for the default gateways and critical servers and hosts off the segments that are being protected to protect the critical assets in the environment.\r\n\r\nCisco IOS XE Software \u2013 Routers\r\n\r\nFor configurations that have a service instance with encapsulation priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can either add the keyword exact after the encapsulation priority-tagged or filter on the ethertype field with encapsulation priority-tagged etype ipv4 , ipv6.\r\n\r\nFor environments that do not have encapsulation priority-tagged assigned to a service instance, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure a service instance that is not assigned to a bridge domain with encapsulation priority-tagged.\r\n\r\nCisco IOS XR Software\r\n\r\nFor configurations that have an l2transport sub interface configured with encapsulation dot1q|dot1ad priority-tagged and where the environment needs to examine only the first tag (depending on the platform), administrators can add the keyword exact after the encapsulation dot1q|dot1ad priority-tagged.\r\n\r\nFor environments that do not have encapsulation dot1q|dot1ad priority-tagged assigned to an l2transport sub interface, to prevent packets that are tagged with dot1p at the front of the headers from being forwarded, administrators can configure l2transport sub interfaces that are not assigned to a bridge domain with encapsulation dot1q priority-tagged and encapsulation dot1ad priority-tagged.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\nmac access-list drop_three_tags\r\n deny any any 0x8100\r\n deny any any 0x88a8\r\n permit any any\r\n!\r\ninterface ethernet 1/4\r\n mac port access-group drop_three_tags\r\n!\r\n\r\n\r\nCisco Small Business Switches\r\n\r\nTo ensure that FHS works correctly on access ports, install a MAC ACL to deny only tagged frames (because they are not to be expected on an access port) or to permit only ARP, IPv4, and IPv6 on all access ports. The following is an example from the Cisco Sx250, 350, and 550 Series Smart Switches and the Cisco Business 250 and 350 Series Smart Switches:\r\n\r\n\r\nmac access-list extended arp-ip-ip6\r\npermit any any 806 0000 ace-priority 1\r\npermit any any 800 0000 ace-priority 2\r\npermit any any 86dd 0000 ace-priority 3\r\n\r\n\r\n      CVE-2021-27861\r\nThe principle for mitigating CVE-2021-27861 is to drop any packets that cannot have their Layer 3 protocol detected using a Layer 2 ACL.\r\n\r\nThe following are examples of Layer 2 ACLs that could be implemented on access ports where FHP has been configured:\r\n\r\nCisco IOS Software \u2013 Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco IOS XR Software\r\n\r\nNo mitigations or workarounds.\r\n\r\nCisco NX-OS Software\r\n\r\n\r\n!\r\ninterface Ethernet1/3\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy HOSTS\r\n!\r\ninterface Ethernet1/4\r\n  switchport\r\n  switchport access vlan 5\r\n  mac port access-group drop_non\r\n  ipv6 nd raguard attach-policy CSCvw92154\r\n!\r\nmac access-list drop_non\r\n  10 permit any any 0x86dd\r\n  20 permit any any ip\r\n  30 permit any any 0x806\r\n  35 permit any 0100.0ccc.cccc 0000.0000.0000\r\n  40 deny any any\r\n!\r\n\r\nCisco Small Business Switches\r\n\r\nNo mitigations or workarounds.\r\n\r\nWhile these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.",
          "product_ids": [
            "CSAFPID-190024"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-190024"
          ]
        }
      ],
      "title": "VU855201: 802.3/802.11 frame conversion can bypass First Hop Security Affecting Cisco Products"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202209-1859",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "nexus 9736pq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 92348gc-x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus x9636q-r",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 9236c",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "sg500-52p",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "nexus 93120tx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "n9k-x9464px",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 93180yc-ex",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "n9k-c9316d-gx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "meraki ms450",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "n9k-x9736c-fx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "802.2",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "ieee",
        "version": "802.2h-1997"
      },
      {
        "model": "sg500-28mpp",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "n9k-x9732c-fx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "sg500x-48mpp",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "catalyst 6504-e",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "nexus 93108tc-fx3p",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 9364c-gx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "n9k-x9636c-r",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 9332c",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 9508",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "sg500x-24",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "nexus 9516",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "sg500-28",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "n9k-c9364d-gx2a",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "sf500-24",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "sg500-28p",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "meraki ms420",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "nexus 93240yc-fx2",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "catalyst 6800ia",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "n9k-x9564px",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "meraki ms410",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "n9k-x9432c-s",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "n9k-c9348d-gx2a",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 93216tc-fx2",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "n9k-c9332d-gx2b",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "meraki ms350",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "catalyst c6832-x-le",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "nexus 93108tc-fx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "sf500-48mp",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "sg500x-24mpp",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "n9k-x97160yc-ex",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "meraki ms355",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "catalyst 6840-x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "n9k-x9464tx2",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "catalyst 6509-v-e",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "catalyst c6816-x-le",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "nexus 9336c-fx2",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 92300yc",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "sf500-18p",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "sf-500-24mp",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "sg500x-48",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "nexus 92304qc",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 9800",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "sg500-52mp",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "p802.1q",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "ietf",
        "version": "d1.0"
      },
      {
        "model": "n9k-x9788tc-fx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 9716d-gx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 9504",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 92160yc-x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 93180yc-fx3",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "n9k-x9564tx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "catalyst 6503-e",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "sf500-24p",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "catalyst 6807-xl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "nexus 9272q",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "sg500x-24p",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "meraki ms425",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "ios xe",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.2\\(07\\)e03"
      },
      {
        "model": "nexus 93180yc-fx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "ios xe",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "17.3.3"
      },
      {
        "model": "meraki ms210",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "n9k-x9736c-ex",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "meraki ms390",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "catalyst c6824-x-le-40g",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "ios xe",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "17.6.1"
      },
      {
        "model": "nexus 9432pq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "n9k-x9636c-rx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "sf500-48",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "catalyst 6509-neb-a",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "catalyst 6880-x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "catalyst 6506-e",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "n9k-c93600cd-gx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 9536pq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "ios xe",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "17.4.1"
      },
      {
        "model": "n9k-x9732c-ex",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "catalyst 6509-e",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "meraki ms250",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "catalyst c6840-x-le-40g",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "sg500x-48p",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "nexus 9336c-fx2-e",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "catalyst 6513-e",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.5\\(01.01.85\\)sy07"
      },
      {
        "model": "nexus 9364c",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "sg500-52",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.0.0.61"
      },
      {
        "model": "nexus 93108tc-ex",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "meraki ms225",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "nexus 9348gc-fxp",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 93360yc-fx2",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "nexus 9636pq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3\\(5\\)"
      },
      {
        "model": "ios xe",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.2\\(07\\)e02"
      },
      {
        "model": "cisco ios xe",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "802.2",
        "scope": null,
        "trust": 0.8,
        "vendor": "ieee",
        "version": null
      },
      {
        "model": "catalyst 6509-e",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "catalyst 6840-x",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "catalyst 6509-neb-a",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "catalyst 6506-e",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "catalyst c6816-x-le",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "ios xe",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "catalyst c6824-x-le-40g",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "catalyst 6509-v-e",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "p802.1q",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u6280\u8853\u30bf\u30b9\u30af\u30d5\u30a9\u30fc\u30b9 ietf",
        "version": null
      },
      {
        "model": "catalyst 6880-x",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "catalyst 6807-xl",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "catalyst c6832-x-le",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "catalyst 6800ia",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "catalyst c6840-x-le-40g",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "catalyst 6503-e",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "catalyst 6504-e",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "catalyst 6513-e",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-020376"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-27853"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "This document was written by Timur Snoke.Statement Date:\u00a0\u00a0 September 27, 2022",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#855201"
      }
    ],
    "trust": 0.8
  },
  "cve": "CVE-2021-27853",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 2.8,
            "id": "CVE-2021-27853",
            "impactScore": 1.4,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Adjacent Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.7,
            "baseSeverity": "Medium",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2021-27853",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2021-27853",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2021-27853",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202209-2794",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-020376"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-2794"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-27853"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers. Layer-2 (L2) network security controls provided by various devices, such as switches, routers, and operating systems, can be bypassed by stacking Ethernet protocol headers. An attacker can send crafted packets through vulnerable devices to cause Denial-of-service (DoS) or to perform a man-in-the-middle (MitM) attack against a target network.CVE-2021-27853 Affected\nCVE-2021-27854 Affected\nCVE-2021-27861 Affected\nCVE-2021-27862 AffectedCVE-2021-27853 Affected\nCVE-2021-27854 Affected\nCVE-2021-27861 Affected\nCVE-2021-27862 Affected. IEEE of ieee 802.2 Products from multiple other vendors contain vulnerabilities related to authentication bypass through spoofing.Information may be tampered with",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-27853"
      },
      {
        "db": "CERT/CC",
        "id": "VU#855201"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-020376"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-27853"
      }
    ],
    "trust": 2.43
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2021-27853",
        "trust": 4.1
      },
      {
        "db": "CERT/CC",
        "id": "VU#855201",
        "trust": 3.2
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-020376",
        "trust": 0.8
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.4805",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-2794",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-27853",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#855201"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-27853"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-020376"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-2794"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-27853"
      }
    ]
  },
  "id": "VAR-202209-1859",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 1.0
  },
  "last_update_date": "2024-08-14T13:21:41.300000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "draft-ietf-v6ops-ra-guard-08 Cisco Systems Cisco\u00a0Security\u00a0Advisory",
        "trust": 0.8,
        "url": "https://standards.ieee.org/ieee/802.1Q/10323/"
      },
      {
        "title": "Multiple Cisco Product security vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=209667"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-020376"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-2794"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-290",
        "trust": 1.0
      },
      {
        "problemtype": "Avoid authentication by spoofing (CWE-290) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-020376"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-27853"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.4,
        "url": "https://blog.champtar.fr/vlan0_llc_snap/"
      },
      {
        "trust": 2.4,
        "url": "https://kb.cert.org/vuls/id/855201"
      },
      {
        "trust": 1.7,
        "url": "https://standards.ieee.org/ieee/802.2/1048/"
      },
      {
        "trust": 1.7,
        "url": "https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/"
      },
      {
        "trust": 1.7,
        "url": "https://standards.ieee.org/ieee/802.1q/10323/"
      },
      {
        "trust": 1.7,
        "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-vu855201-j3z8cktx"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/ta/jvnta96784241/"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-27853"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2021-27853/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.4805"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/cisco-juniper-ingress-filtrering-bypass-via-layer-2-39380"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2021-27853"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-020376"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-2794"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-27853"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#855201"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-27853"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-020376"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-2794"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-27853"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-09-27T00:00:00",
        "db": "CERT/CC",
        "id": "VU#855201"
      },
      {
        "date": "2022-09-27T00:00:00",
        "db": "VULMON",
        "id": "CVE-2021-27853"
      },
      {
        "date": "2023-10-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2021-020376"
      },
      {
        "date": "2022-09-27T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202209-2794"
      },
      {
        "date": "2022-09-27T18:15:09.527000",
        "db": "NVD",
        "id": "CVE-2021-27853"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-10-03T00:00:00",
        "db": "CERT/CC",
        "id": "VU#855201"
      },
      {
        "date": "2022-09-27T00:00:00",
        "db": "VULMON",
        "id": "CVE-2021-27853"
      },
      {
        "date": "2023-10-20T06:17:00",
        "db": "JVNDB",
        "id": "JVNDB-2021-020376"
      },
      {
        "date": "2022-10-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202209-2794"
      },
      {
        "date": "2022-11-16T17:26:33.420000",
        "db": "NVD",
        "id": "CVE-2021-27853"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote or local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-2794"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "L2 network security controls can be bypassed using VLAN 0 stacking and/or 802.3 headers",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#855201"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-2794"
      }
    ],
    "trust": 0.6
  }
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Cisco Internetwork Operating System (IOS) ist ein Betriebssystem, das f\u00fcr Cisco Ger\u00e4te wie z. B. Router und Switches eingesetzt wird.\r\nCatalyst ist der Markenname f\u00fcr eine Vielzahl von Netzwerk-Switches die von Cisco Systems verkauft werden.\r\nCisco Industrial Ethernet Series ist eine Familie von Switches f\u00fcr  eine robuste, einfach zu bedienende, sichere Infrastruktur f\u00fcr raue Umgebungen.\r\nBei der Cisco Nexus Serie handelt es sich um modulare Switching-Systeme der Data Center-Klasse.\r\nDie Cisco Small Business Produktfamilie beinhaltet Netzwerk-, Kommunikations-, WLAN- und Sicherheitsprodukte, sowie Router und Switche.\r\nWiFi Access Point bezeichnet eine Produktfamilie von WLAN Zugriffspunkten von Arista.\r\nArista Extensible Operating System (EOS) ist ein modulares Linux basiertes Netzwerkbetriebssystem.\r\nJUNOS ist das \"Juniper Network Operating System\", das in Juniper Appliances verwendet wird.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Layer 2 Netzwerksicherheitskontrollen in mehreren Produkten ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-1551 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1551.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-1551 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1551"
      },
      {
        "category": "external",
        "summary": "Arista Security Advisory",
        "url": "https://www.arista.com/jp/support/advisories-notices/security-advisory/16276-security-advisory-0080"
      },
      {
        "category": "external",
        "summary": "CERT Coordination Center VU#855201 vom 2022-09-27",
        "url": "https://www.kb.cert.org/vuls/id/855201"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory",
        "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX"
      },
      {
        "category": "external",
        "summary": "Arista Security Advisory",
        "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/16276-security-advisory-0080"
      },
      {
        "category": "external",
        "summary": "Lenovo Security Advisory LEN-68035 vom 2022-10-11",
        "url": "https://support.lenovo.com/us/en/product_security/LEN-68035"
      },
      {
        "category": "external",
        "summary": "ExtremeNetworks Security Advisory SA-2022-028 vom 2022-10-20",
        "url": "https://extremeportal.force.com/ExtrArticleDetail?an=000107398"
      },
      {
        "category": "external",
        "summary": "ExtremeNetworks Security Advisory SA-2022-026 vom 2022-10-20",
        "url": "https://extremeportal.force.com/ExtrArticleDetail?an=000107396"
      }
    ],
    "source_lang": "en-US",
    "title": "Layer 2 Netzwerksicherheitskontrollen: Mehrere Schwachstellen erm\u00f6glichen Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2023-10-04T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:35:47.217+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2022-1551",
      "initial_release_date": "2022-09-27T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-09-27T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2022-10-11T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von LENOVO aufgenommen"
        },
        {
          "date": "2022-10-20T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2023-10-04T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates aufgenommen"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Arista EOS",
                "product": {
                  "name": "Arista EOS",
                  "product_id": "T007958",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:arista:arista_eos:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista EOS \u003c 4.28.3M",
                "product": {
                  "name": "Arista EOS \u003c 4.28.3M",
                  "product_id": "T024723",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:arista:arista_eos:4.28.3m"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista EOS \u003c 4.26.8M",
                "product": {
                  "name": "Arista EOS \u003c 4.26.8M",
                  "product_id": "T024724",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:arista:arista_eos:4.26.8m"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista EOS \u003c 4.24.11M",
                "product": {
                  "name": "Arista EOS \u003c 4.24.11M",
                  "product_id": "T024725",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:arista:arista_eos:4.24.11m"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista EOS \u003c 4.23.13M",
                "product": {
                  "name": "Arista EOS \u003c 4.23.13M",
                  "product_id": "T024726",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:arista:arista_eos:4.23.13m"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista EOS \u003c 4.22.13M",
                "product": {
                  "name": "Arista EOS \u003c 4.22.13M",
                  "product_id": "T024727",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:arista:arista_eos:4.22.13m"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "EOS"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Arista WiFi Access Point",
                "product": {
                  "name": "Arista WiFi Access Point",
                  "product_id": "T019358",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:arista:wifi_access_point:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista WiFi Access Point \u003c 12.0.1-48.10",
                "product": {
                  "name": "Arista WiFi Access Point \u003c 12.0.1-48.10",
                  "product_id": "T024728",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:arista:wifi_access_point:12.0.1-48.10"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista WiFi Access Point \u003c 11.0.1-49.17",
                "product": {
                  "name": "Arista WiFi Access Point \u003c 11.0.1-49.17",
                  "product_id": "T024729",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:arista:wifi_access_point:11.0.1-49.17"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "WiFi Access Point"
          }
        ],
        "category": "vendor",
        "name": "Arista"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Broadcom Brocade Switch",
            "product": {
              "name": "Broadcom Brocade Switch",
              "product_id": "T015844",
              "product_identification_helper": {
                "cpe": "cpe:/h:brocade:switch:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Broadcom"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Cisco Catalyst",
            "product": {
              "name": "Cisco Catalyst",
              "product_id": "T000491",
              "product_identification_helper": {
                "cpe": "cpe:/h:cisco:catalyst:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Cisco IOS XE \u003c 17.6.3",
                "product": {
                  "name": "Cisco IOS XE \u003c 17.6.3",
                  "product_id": "T024721",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:ios_xe:17.6.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco IOS XE \u003c 17.8.1",
                "product": {
                  "name": "Cisco IOS XE \u003c 17.8.1",
                  "product_id": "T024722",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:ios_xe:17.8.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "IOS XE"
          },
          {
            "category": "product_name",
            "name": "Cisco IOS XR",
            "product": {
              "name": "Cisco IOS XR",
              "product_id": "2062",
              "product_identification_helper": {
                "cpe": "cpe:/o:cisco:ios_xr:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco Industrial Ethernet Switches",
            "product": {
              "name": "Cisco Industrial Ethernet Switches",
              "product_id": "T012156",
              "product_identification_helper": {
                "cpe": "cpe:/h:cisco:industrial_ethernet_switches:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco Nexus",
            "product": {
              "name": "Cisco Nexus",
              "product_id": "T004033",
              "product_identification_helper": {
                "cpe": "cpe:/h:cisco:nexus:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco Small Business",
            "product": {
              "name": "Cisco Small Business",
              "product_id": "T006607",
              "product_identification_helper": {
                "cpe": "cpe:/h:cisco:small_business:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Extreme Networks ExtremeXOS",
            "product": {
              "name": "Extreme Networks ExtremeXOS",
              "product_id": "T020452",
              "product_identification_helper": {
                "cpe": "cpe:/o:extremenetworks:extremexos:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Extreme Networks"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Juniper JUNOS",
            "product": {
              "name": "Juniper JUNOS",
              "product_id": "5930",
              "product_identification_helper": {
                "cpe": "cpe:/o:juniper:junos:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Juniper"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-27853",
      "notes": [
        {
          "category": "description",
          "text": "Layer 2 (L2) Netzwerksicherheitskontrollen, die von Switches, Routern und Betriebssystemen genutzt werden, k\u00f6nnen durch das Stapeln von Ethernet-Protokoll-Headern umgangen werden. Ein Angreifer aus dem angrenzenden Netzwerk kann dies ausnutzen indem er manipulierte Pakete \u00fcber anf\u00e4llige Ger\u00e4te sendet. In der Folge kann er einen Denial-of-Service- oder einen Man-in-the-Middle Angriff gegen ein Zielnetzwerk durchzuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T004033",
          "T019358",
          "T015844",
          "5930",
          "T006607",
          "T007958",
          "T012156",
          "T020452",
          "2062",
          "T000491"
        ]
      },
      "release_date": "2022-09-27T22:00:00.000+00:00",
      "title": "CVE-2021-27853"
    },
    {
      "cve": "CVE-2021-27854",
      "notes": [
        {
          "category": "description",
          "text": "Layer 2 (L2) Netzwerksicherheitskontrollen, die von Switches, Routern und Betriebssystemen genutzt werden, k\u00f6nnen durch das Stapeln von Ethernet-Protokoll-Headern umgangen werden. Ein Angreifer aus dem angrenzenden Netzwerk kann dies ausnutzen indem er manipulierte Pakete \u00fcber anf\u00e4llige Ger\u00e4te sendet. In der Folge kann er einen Denial-of-Service- oder einen Man-in-the-Middle Angriff gegen ein Zielnetzwerk durchzuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T004033",
          "T019358",
          "T015844",
          "5930",
          "T006607",
          "T007958",
          "T012156",
          "T020452",
          "2062",
          "T000491"
        ]
      },
      "release_date": "2022-09-27T22:00:00.000+00:00",
      "title": "CVE-2021-27854"
    },
    {
      "cve": "CVE-2021-27861",
      "notes": [
        {
          "category": "description",
          "text": "Layer 2 (L2) Netzwerksicherheitskontrollen, die von Switches, Routern und Betriebssystemen genutzt werden, k\u00f6nnen durch das Stapeln von Ethernet-Protokoll-Headern umgangen werden. Ein Angreifer aus dem angrenzenden Netzwerk kann dies ausnutzen indem er manipulierte Pakete \u00fcber anf\u00e4llige Ger\u00e4te sendet. In der Folge kann er einen Denial-of-Service- oder einen Man-in-the-Middle Angriff gegen ein Zielnetzwerk durchzuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T004033",
          "T019358",
          "T015844",
          "5930",
          "T006607",
          "T007958",
          "T012156",
          "T020452",
          "2062",
          "T000491"
        ]
      },
      "release_date": "2022-09-27T22:00:00.000+00:00",
      "title": "CVE-2021-27861"
    },
    {
      "cve": "CVE-2021-27862",
      "notes": [
        {
          "category": "description",
          "text": "Layer 2 (L2) Netzwerksicherheitskontrollen, die von Switches, Routern und Betriebssystemen genutzt werden, k\u00f6nnen durch das Stapeln von Ethernet-Protokoll-Headern umgangen werden. Ein Angreifer aus dem angrenzenden Netzwerk kann dies ausnutzen indem er manipulierte Pakete \u00fcber anf\u00e4llige Ger\u00e4te sendet. In der Folge kann er einen Denial-of-Service- oder einen Man-in-the-Middle Angriff gegen ein Zielnetzwerk durchzuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T004033",
          "T019358",
          "T015844",
          "5930",
          "T006607",
          "T007958",
          "T012156",
          "T020452",
          "2062",
          "T000491"
        ]
      },
      "release_date": "2022-09-27T22:00:00.000+00:00",
      "title": "CVE-2021-27862"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Cisco Internetwork Operating System (IOS) ist ein Betriebssystem, das f\u00fcr Cisco Ger\u00e4te wie z. B. Router und Switches eingesetzt wird.\r\nCatalyst ist der Markenname f\u00fcr eine Vielzahl von Netzwerk-Switches die von Cisco Systems verkauft werden.\r\nCisco Industrial Ethernet Series ist eine Familie von Switches f\u00fcr  eine robuste, einfach zu bedienende, sichere Infrastruktur f\u00fcr raue Umgebungen.\r\nBei der Cisco Nexus Serie handelt es sich um modulare Switching-Systeme der Data Center-Klasse.\r\nDie Cisco Small Business Produktfamilie beinhaltet Netzwerk-, Kommunikations-, WLAN- und Sicherheitsprodukte, sowie Router und Switche.\r\nWiFi Access Point bezeichnet eine Produktfamilie von WLAN Zugriffspunkten von Arista.\r\nArista Extensible Operating System (EOS) ist ein modulares Linux basiertes Netzwerkbetriebssystem.\r\nJUNOS ist das \"Juniper Network Operating System\", das in Juniper Appliances verwendet wird.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Layer 2 Netzwerksicherheitskontrollen in mehreren Produkten ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-1551 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1551.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-1551 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1551"
      },
      {
        "category": "external",
        "summary": "Arista Security Advisory",
        "url": "https://www.arista.com/jp/support/advisories-notices/security-advisory/16276-security-advisory-0080"
      },
      {
        "category": "external",
        "summary": "CERT Coordination Center VU#855201 vom 2022-09-27",
        "url": "https://www.kb.cert.org/vuls/id/855201"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory",
        "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX"
      },
      {
        "category": "external",
        "summary": "Arista Security Advisory",
        "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/16276-security-advisory-0080"
      },
      {
        "category": "external",
        "summary": "Lenovo Security Advisory LEN-68035 vom 2022-10-11",
        "url": "https://support.lenovo.com/us/en/product_security/LEN-68035"
      },
      {
        "category": "external",
        "summary": "ExtremeNetworks Security Advisory SA-2022-028 vom 2022-10-20",
        "url": "https://extremeportal.force.com/ExtrArticleDetail?an=000107398"
      },
      {
        "category": "external",
        "summary": "ExtremeNetworks Security Advisory SA-2022-026 vom 2022-10-20",
        "url": "https://extremeportal.force.com/ExtrArticleDetail?an=000107396"
      }
    ],
    "source_lang": "en-US",
    "title": "Layer 2 Netzwerksicherheitskontrollen: Mehrere Schwachstellen erm\u00f6glichen Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2023-10-04T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:35:47.217+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2022-1551",
      "initial_release_date": "2022-09-27T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-09-27T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2022-10-11T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von LENOVO aufgenommen"
        },
        {
          "date": "2022-10-20T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2023-10-04T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates aufgenommen"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Arista EOS",
                "product": {
                  "name": "Arista EOS",
                  "product_id": "T007958",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:arista:arista_eos:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista EOS \u003c 4.28.3M",
                "product": {
                  "name": "Arista EOS \u003c 4.28.3M",
                  "product_id": "T024723",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:arista:arista_eos:4.28.3m"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista EOS \u003c 4.26.8M",
                "product": {
                  "name": "Arista EOS \u003c 4.26.8M",
                  "product_id": "T024724",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:arista:arista_eos:4.26.8m"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista EOS \u003c 4.24.11M",
                "product": {
                  "name": "Arista EOS \u003c 4.24.11M",
                  "product_id": "T024725",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:arista:arista_eos:4.24.11m"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista EOS \u003c 4.23.13M",
                "product": {
                  "name": "Arista EOS \u003c 4.23.13M",
                  "product_id": "T024726",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:arista:arista_eos:4.23.13m"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista EOS \u003c 4.22.13M",
                "product": {
                  "name": "Arista EOS \u003c 4.22.13M",
                  "product_id": "T024727",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:arista:arista_eos:4.22.13m"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "EOS"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Arista WiFi Access Point",
                "product": {
                  "name": "Arista WiFi Access Point",
                  "product_id": "T019358",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:arista:wifi_access_point:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista WiFi Access Point \u003c 12.0.1-48.10",
                "product": {
                  "name": "Arista WiFi Access Point \u003c 12.0.1-48.10",
                  "product_id": "T024728",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:arista:wifi_access_point:12.0.1-48.10"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Arista WiFi Access Point \u003c 11.0.1-49.17",
                "product": {
                  "name": "Arista WiFi Access Point \u003c 11.0.1-49.17",
                  "product_id": "T024729",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:arista:wifi_access_point:11.0.1-49.17"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "WiFi Access Point"
          }
        ],
        "category": "vendor",
        "name": "Arista"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Broadcom Brocade Switch",
            "product": {
              "name": "Broadcom Brocade Switch",
              "product_id": "T015844",
              "product_identification_helper": {
                "cpe": "cpe:/h:brocade:switch:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Broadcom"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Cisco Catalyst",
            "product": {
              "name": "Cisco Catalyst",
              "product_id": "T000491",
              "product_identification_helper": {
                "cpe": "cpe:/h:cisco:catalyst:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Cisco IOS XE \u003c 17.6.3",
                "product": {
                  "name": "Cisco IOS XE \u003c 17.6.3",
                  "product_id": "T024721",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:ios_xe:17.6.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco IOS XE \u003c 17.8.1",
                "product": {
                  "name": "Cisco IOS XE \u003c 17.8.1",
                  "product_id": "T024722",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:ios_xe:17.8.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "IOS XE"
          },
          {
            "category": "product_name",
            "name": "Cisco IOS XR",
            "product": {
              "name": "Cisco IOS XR",
              "product_id": "2062",
              "product_identification_helper": {
                "cpe": "cpe:/o:cisco:ios_xr:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco Industrial Ethernet Switches",
            "product": {
              "name": "Cisco Industrial Ethernet Switches",
              "product_id": "T012156",
              "product_identification_helper": {
                "cpe": "cpe:/h:cisco:industrial_ethernet_switches:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco Nexus",
            "product": {
              "name": "Cisco Nexus",
              "product_id": "T004033",
              "product_identification_helper": {
                "cpe": "cpe:/h:cisco:nexus:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco Small Business",
            "product": {
              "name": "Cisco Small Business",
              "product_id": "T006607",
              "product_identification_helper": {
                "cpe": "cpe:/h:cisco:small_business:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Extreme Networks ExtremeXOS",
            "product": {
              "name": "Extreme Networks ExtremeXOS",
              "product_id": "T020452",
              "product_identification_helper": {
                "cpe": "cpe:/o:extremenetworks:extremexos:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Extreme Networks"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Juniper JUNOS",
            "product": {
              "name": "Juniper JUNOS",
              "product_id": "5930",
              "product_identification_helper": {
                "cpe": "cpe:/o:juniper:junos:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Juniper"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-27853",
      "notes": [
        {
          "category": "description",
          "text": "Layer 2 (L2) Netzwerksicherheitskontrollen, die von Switches, Routern und Betriebssystemen genutzt werden, k\u00f6nnen durch das Stapeln von Ethernet-Protokoll-Headern umgangen werden. Ein Angreifer aus dem angrenzenden Netzwerk kann dies ausnutzen indem er manipulierte Pakete \u00fcber anf\u00e4llige Ger\u00e4te sendet. In der Folge kann er einen Denial-of-Service- oder einen Man-in-the-Middle Angriff gegen ein Zielnetzwerk durchzuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T004033",
          "T019358",
          "T015844",
          "5930",
          "T006607",
          "T007958",
          "T012156",
          "T020452",
          "2062",
          "T000491"
        ]
      },
      "release_date": "2022-09-27T22:00:00.000+00:00",
      "title": "CVE-2021-27853"
    },
    {
      "cve": "CVE-2021-27854",
      "notes": [
        {
          "category": "description",
          "text": "Layer 2 (L2) Netzwerksicherheitskontrollen, die von Switches, Routern und Betriebssystemen genutzt werden, k\u00f6nnen durch das Stapeln von Ethernet-Protokoll-Headern umgangen werden. Ein Angreifer aus dem angrenzenden Netzwerk kann dies ausnutzen indem er manipulierte Pakete \u00fcber anf\u00e4llige Ger\u00e4te sendet. In der Folge kann er einen Denial-of-Service- oder einen Man-in-the-Middle Angriff gegen ein Zielnetzwerk durchzuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T004033",
          "T019358",
          "T015844",
          "5930",
          "T006607",
          "T007958",
          "T012156",
          "T020452",
          "2062",
          "T000491"
        ]
      },
      "release_date": "2022-09-27T22:00:00.000+00:00",
      "title": "CVE-2021-27854"
    },
    {
      "cve": "CVE-2021-27861",
      "notes": [
        {
          "category": "description",
          "text": "Layer 2 (L2) Netzwerksicherheitskontrollen, die von Switches, Routern und Betriebssystemen genutzt werden, k\u00f6nnen durch das Stapeln von Ethernet-Protokoll-Headern umgangen werden. Ein Angreifer aus dem angrenzenden Netzwerk kann dies ausnutzen indem er manipulierte Pakete \u00fcber anf\u00e4llige Ger\u00e4te sendet. In der Folge kann er einen Denial-of-Service- oder einen Man-in-the-Middle Angriff gegen ein Zielnetzwerk durchzuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T004033",
          "T019358",
          "T015844",
          "5930",
          "T006607",
          "T007958",
          "T012156",
          "T020452",
          "2062",
          "T000491"
        ]
      },
      "release_date": "2022-09-27T22:00:00.000+00:00",
      "title": "CVE-2021-27861"
    },
    {
      "cve": "CVE-2021-27862",
      "notes": [
        {
          "category": "description",
          "text": "Layer 2 (L2) Netzwerksicherheitskontrollen, die von Switches, Routern und Betriebssystemen genutzt werden, k\u00f6nnen durch das Stapeln von Ethernet-Protokoll-Headern umgangen werden. Ein Angreifer aus dem angrenzenden Netzwerk kann dies ausnutzen indem er manipulierte Pakete \u00fcber anf\u00e4llige Ger\u00e4te sendet. In der Folge kann er einen Denial-of-Service- oder einen Man-in-the-Middle Angriff gegen ein Zielnetzwerk durchzuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T004033",
          "T019358",
          "T015844",
          "5930",
          "T006607",
          "T007958",
          "T012156",
          "T020452",
          "2062",
          "T000491"
        ]
      },
      "release_date": "2022-09-27T22:00:00.000+00:00",
      "title": "CVE-2021-27862"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2021-27853",
    "id": "GSD-2021-27853",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-27853.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-27853"
      ],
      "details": "Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.",
      "id": "GSD-2021-27853",
      "modified": "2023-12-13T01:23:35.859457Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cert@cert.org",
        "DATE_PUBLIC": "2022-09-27T01:00:00.000Z",
        "ID": "CVE-2021-27853",
        "STATE": "PUBLIC",
        "TITLE": "L2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "802.2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "802.2h-1997",
                          "version_value": "802.2h-1997"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "IEEE"
            },
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "draft-ietf-v6ops-ra-guard",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "08",
                          "version_value": "08"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "IETF"
            },
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "P802.1Q",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "D1.0",
                          "version_value": "D1.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "IETF"
            }
          ]
        }
      },
      "credit": [
        {
          "lang": "eng",
          "value": "Etienne Champetier (@champtar) \u003cchampetier.etienne@gmail.com\u003e "
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-290: Authentication Bypass by Spoofing"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/",
            "refsource": "MISC",
            "url": "https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/"
          },
          {
            "name": "https://standards.ieee.org/ieee/802.2/1048/",
            "refsource": "MISC",
            "url": "https://standards.ieee.org/ieee/802.2/1048/"
          },
          {
            "name": "https://standards.ieee.org/ieee/802.1Q/10323/",
            "refsource": "MISC",
            "url": "https://standards.ieee.org/ieee/802.1Q/10323/"
          },
          {
            "name": "20220927 Vulnerabilities in Layer 2 Network Security Controls Affecting Cisco Products: September 2022",
            "refsource": "CISCO",
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX"
          },
          {
            "name": "https://kb.cert.org/vuls/id/855201",
            "refsource": "MISC",
            "url": "https://kb.cert.org/vuls/id/855201"
          },
          {
            "name": "https://blog.champtar.fr/VLAN0_LLC_SNAP/",
            "refsource": "MISC",
            "url": "https://blog.champtar.fr/VLAN0_LLC_SNAP/"
          }
        ]
      },
      "source": {
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:ieee:ieee_802.2:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "802.2h-1997",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:ietf:p802.1q:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "d1.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_6503-e_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_6503-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_6504-e_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_6504-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_6506-e_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_6506-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_6509-e_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_6509-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_6509-neb-a_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_6509-neb-a:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_6509-v-e_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_6509-v-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_6513-e_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_6513-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_6807-xl_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_6807-xl:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_6840-x_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_6840-x:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_6880-x_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_6880-x:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_c6816-x-le_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_c6816-x-le:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_c6824-x-le-40g_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_c6824-x-le-40g:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_c6832-x-le_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_c6832-x-le:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_c6840-x-le-40g_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_c6840-x-le-40g:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:catalyst_6800ia_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_6800ia:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios_xe:17.4.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios_xe:17.6.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:ios_xe:17.3.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios_xe:15.2\\(07\\)e03:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios_xe:15.2\\(07\\)e02:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48xs-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24pdm-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-32xs-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-8x24pd-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48xs-f-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-12x48uq-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-12s-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-12x48ur-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24pd-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24td-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48fs-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24u-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-8x24uq-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-12x48fd-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24s-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-8x24pd-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48t-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24xu-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24t-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48ps-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-16xs-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48tq-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24p-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48fqm-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48fq-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48p-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24u-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-12x48uq-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24ps-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24pd-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48t-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48f-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-12s-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_c3850-12x48u-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24ts-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24xu-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48xs-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24ps-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24pd-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24pdm-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48u-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48fs-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24td-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-16xs-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48fq-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48u-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-8x24uq-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-32xs-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48pd-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48pd-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48f-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-12x48ur-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48fq-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48u-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24p-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24xs-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48tq-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48p-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48p-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48pq-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24t-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48xs-f-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48fqm-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24u-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48t-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24ts-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24ps-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-12x48ur-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48ts-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48fs-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48pd-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48ts-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24t-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48fd-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-8x24uq-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-12xs-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48fqm-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48ps-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24xs-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48fd-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48tq-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24pdm-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-12x48fd-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24ts-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24s-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-12xs-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_c3850-12x48u-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48fd-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-12x48uz-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48ps-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_c3850-12x48u-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48pq-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-8x24pd-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-12x48uq-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48td-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-24td-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24xu-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48td-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48ts-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48td-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48f-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-48pq-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-12x48fd-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-24pw-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3850-48pw-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_9300:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_9300l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-12x48uz-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_3650-12x48uz-l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_9500:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_9400:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_9200:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_9600:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_9500h:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_9200l:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_9200cx:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_9300x:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_9300lm:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:catalyst_9600x:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:meraki_ms390_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:meraki_ms390:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:meraki_ms210_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:meraki_ms210:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:meraki_ms225_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:meraki_ms225:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:meraki_ms250_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:meraki_ms250:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:meraki_ms350_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:meraki_ms350:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:meraki_ms355_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:meraki_ms355:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:meraki_ms410_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:meraki_ms410:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:meraki_ms420_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:meraki_ms420:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:meraki_ms425_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:meraki_ms425:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:meraki_ms450_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:meraki_ms450:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_93180yc-ex_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_93180yc-ex:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_93180yc-fx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_93180yc-fx:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_93180yc-fx3_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_93180yc-fx3:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_93240yc-fx2_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_93240yc-fx2:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_93360yc-fx2_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_93360yc-fx2:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_93120tx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_93120tx:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_93108tc-ex_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_93108tc-ex:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9348gc-fxp_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9348gc-fxp:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_93108tc-fx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_93108tc-fx:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_93108tc-fx3p_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_93108tc-fx3p:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_93216tc-fx2_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_93216tc-fx2:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-c9316d-gx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-c9316d-gx:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-c93600cd-gx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-c93600cd-gx:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-c9332d-gx2b_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-c9332d-gx2b:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-c9348d-gx2a_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-c9348d-gx2a:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-c9364d-gx2a_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-c9364d-gx2a:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-x97160yc-ex_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-x97160yc-ex:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-x9788tc-fx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-x9788tc-fx:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-x9564px_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-x9564px:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-x9464px_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-x9464px:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-x9564tx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-x9564tx:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-x9464tx2_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-x9464tx2:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9636pq_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9636pq:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_x9636q-r_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_x9636q-r:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9536pq_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9536pq:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9432pq_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9432pq:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9736pq_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9736pq:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-x9736c-fx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-x9736c-fx:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-x9732c-ex_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-x9732c-ex:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-x9732c-fx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-x9732c-fx:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-x9736c-ex_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-x9736c-ex:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-x9636c-rx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-x9636c-rx:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-x9636c-r_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-x9636c-r:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:n9k-x9432c-s_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:n9k-x9432c-s:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9716d-gx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9716d-gx:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9504_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9504:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9508_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9508:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9516_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9516:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_92160yc-x_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_92160yc-x:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9272q_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9272q:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_92304qc_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_92304qc:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9236c_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9236c:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_92300yc_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_92300yc:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_92348gc-x_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_92348gc-x:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9364c_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9364c:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9336c-fx2_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9336c-fx2:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9336c-fx2-e_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9336c-fx2-e:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9332c_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9332c:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9364c-gx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9364c-gx:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:nexus_9800_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:nexus_9800:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sf500-24_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sf500-24:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sf-500-24mp_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sf-500-24mp:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sf500-24p_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sf500-24p:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sf500-48_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sf500-48:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sf500-48mp_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sf500-48mp:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sf500-18p_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sf500-18p:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sg500-28_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sg500-28:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sg500-28mpp_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sg500-28mpp:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sg500-28p_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sg500-28p:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sg500-52_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sg500-52:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sg500-52mp_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sg500-52mp:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sg500-52p_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sg500-52p:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sg500x-24_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sg500x-24:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sg500x-24mpp_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sg500x-24mpp:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sg500x-24p_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sg500x-24p:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sg500x-48_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sg500x-48:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sg500x-48mpp_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sg500x-48mpp:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:sg500x-48p_firmware:3.0.0.61:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:sg500x-48p:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2021-27853"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-290"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "N/A",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://standards.ieee.org/ieee/802.2/1048/"
            },
            {
              "name": "N/A",
              "refsource": "CONFIRM",
              "tags": [
                "Technical Description",
                "Third Party Advisory"
              ],
              "url": "https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/"
            },
            {
              "name": "N/A",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://standards.ieee.org/ieee/802.1Q/10323/"
            },
            {
              "name": "20220927 Vulnerabilities in Layer 2 Network Security Controls Affecting Cisco Products: September 2022",
              "refsource": "CISCO",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX"
            },
            {
              "name": "https://kb.cert.org/vuls/id/855201",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "US Government Resource"
              ],
              "url": "https://kb.cert.org/vuls/id/855201"
            },
            {
              "name": "https://blog.champtar.fr/VLAN0_LLC_SNAP/",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://blog.champtar.fr/VLAN0_LLC_SNAP/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2022-11-16T17:26Z",
      "publishedDate": "2022-09-27T18:15Z"
    }
  }
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ieee:ieee_802.2:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5B0DDC2-21C5-4682-9AA2-055BF7C722DA",
              "versionEndIncluding": "802.2h-1997",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ietf:p802.1q:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "94105D2E-950F-4290-8840-301FA908BC8C",
              "versionEndIncluding": "d1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_6503-e_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "0EB1288B-9956-48E6-9CB5-6745321535EC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_6503-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F202892E-2E58-4D77-B983-38AFA51CDBC6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_6504-e_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E7F0575-238D-4D3D-A8BA-6099AA66FC8B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_6504-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F57DF3E-4069-4EF0-917E-84CDDFCEBEEF",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_6506-e_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "7999EE9B-13CD-4B82-B5B6-0362047E302E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_6506-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BE25114-ABBC-47A0-9C20-E8D40D721313",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_6509-e_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BC3DDFB-FCF3-4A26-BD98-560B4CBE693C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_6509-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FADD5F49-2817-40EC-861C-C922825708BD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_6509-neb-a_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "265673EE-7C0A-438A-B990-00D3955990A3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_6509-neb-a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E628F9C4-98C6-4A95-AF81-F1E6A56E8648",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_6509-v-e_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "ADD8F4E5-4C95-4087-AC04-01EF96B3B800",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_6509-v-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AFF899C-1EB3-46D8-9003-EA36A68C90B3",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_6513-e_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "C01135F5-ADC7-4926-B52E-8B3195689D71",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_6513-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D8668D34-096B-4FC3-B9B1-0ECFD6265778",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_6807-xl_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B073160-BCE7-4452-8EC2-2E02FD576AC1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_6807-xl:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC15C966-394F-4582-AF70-5FA64AA45A04",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_6840-x_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "55CA7E04-9FA4-4010-8281-BE09EB88EDC3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_6840-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2809C844-98D0-4967-A226-D83F374E31D9",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_6880-x_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "870449B1-1A49-48E3-9C32-A359215BBA02",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_6880-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6008F8FF-386D-42E0-873A-DA587888B813",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_c6816-x-le_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "36DFD7A3-7AC8-4AD9-9943-B77392021DDF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c6816-x-le:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7FF5CD42-B457-4EC7-9F9A-5A0DB190FBAD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_c6824-x-le-40g_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "F89261F4-737E-44A7-B619-A2062955A408",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c6824-x-le-40g:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F89C8BF9-7CE9-4BE1-8C3B-79481174A2C1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_c6832-x-le_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "F074E9B3-32A9-478C-AAAC-7FCAD52ED53C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c6832-x-le:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B924243E-DC68-4F39-A969-14DAF4C76017",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_c6840-x-le-40g_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8FDB207-4A98-4136-8B12-B6DA89ECE803",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c6840-x-le-40g:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B85D839-33E1-462F-99CB-82BB0B4338E6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:catalyst_6800ia_firmware:15.5\\(01.01.85\\)sy07:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCCEBB30-3D8A-46BD-98D4-6EEB303E6EC7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_6800ia:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C403BC03-1F2B-47AF-8D4B-50AF9E44FB09",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:ios_xe:17.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "95B4B461-5E35-40BF-8441-3B95BB341055",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xe:15.2\\(07\\)e02:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6EFD825-7EB4-4311-9DAD-F128CB6ABFB2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xe:15.2\\(07\\)e03:*:*:*:*:*:*:*",
              "matchCriteriaId": "2364BBAA-2E63-454D-A16A-9D46751E40FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xe:17.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A6B707B-4543-41F1-83DF-49A93BF56FB1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xe:17.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4DE62C4B-7C06-4907-BADE-416C1618D2D9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-12x48fd-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EE4F60E-DF3D-4839-8731-7CF16DA8FF26",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-12x48fd-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8EA5EEE3-A084-46B4-84C0-ADFD69800649",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-12x48fd-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "592F67D5-344B-49AF-A277-1089A40AC2FD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-12x48uq-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB2A5355-BF40-437C-8683-A7A81DEE362C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-12x48uq-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "43F4B90E-3499-45D4-864D-18505E2149F2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-12x48uq-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1B9BE6BA-6B2D-47C9-B8F1-3C9CE213948D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-12x48ur-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE5FCCFF-E491-474F-9B86-AB51D8244582",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-12x48ur-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA8464F8-D6D2-4165-ADE8-B40F7D8556C2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-12x48ur-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "61007628-A81B-43E0-86DE-1F7DDAD9F1A7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-12x48uz-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C3F03C3-C0CA-4E9B-A99A-BE28153EB5C9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-12x48uz-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B39F250E-6A89-4537-BD31-1FB81734A9A1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-12x48uz-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB4E3B69-DDE8-4EA2-8E63-D6EEF41083B3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24pd-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A369CD35-1242-4556-A83D-BD69CC149CFA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24pd-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA2D1B9E-6234-4FD6-A003-AFBC8A4DC2E6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24pd-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "784A1499-1F33-493D-B433-EB2550C03C19",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24pdm-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CECFC88D-5480-46E4-BF74-E11A514A8BDD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24pdm-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E54D16A8-0407-41E3-9599-9A6F57E1AA75",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24pdm-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C94A9A21-C4F7-4EA4-95B1-DEA7DDA0F77D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24ps-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF3818CC-8653-4A9E-A57B-950A15914D6B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24ps-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EDC790B-B42D-45DB-ACF5-A789F76C2BC4",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24ps-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2A6BC84-91F2-437D-9D2E-F8B3F5966767",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24td-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F331F13-5D05-4213-B442-D48D8E22287B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24td-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E312F4-90DA-40E4-BCD1-92F41BEEEECF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24td-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA32EA3F-946D-430D-B00F-939D828DD72C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24ts-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D239A09C-34D2-4418-B538-03A1080B8479",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24ts-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C84561E-DD99-4433-9EF2-083F7C300123",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-24ts-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B29871BE-CA7D-4108-B46A-CBD539C9A2B8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48fd-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "39CD9189-6524-4157-B90E-FF6A81DE3599",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48fd-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2CF1B702-643A-4AF2-B0AD-3C540CF85F2A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48fd-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "96269625-CB31-4850-872B-B2C1321B13B6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48fq-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BDE086A-3FE5-46E3-BD66-23D0AE5089BE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48fq-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA53775A-D3ED-4D34-8338-A384DBEB94E5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48fq-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE7D4522-D6BB-467F-AF5D-4D753A89D524",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48fqm-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C680534-C663-40B0-A4AA-7F292EE60FE2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48fqm-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BAF4F233-7B47-46ED-BDC5-A589BCFC0B39",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48fqm-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A528EC0-4650-4787-BE52-A588E7E38A31",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48fs-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "53898E96-03D6-43A2-AE05-46C62464BD26",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48fs-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "465917E5-8BF0-4BBB-85A0-DE8F516880C9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48fs-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9FA66D9-E465-406E-A95C-608A1BE34D74",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48pd-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4EFFE6E6-413F-48AC-B4CE-0F1058C48FC2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48pd-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1456B204-A2A5-4790-A684-7F50D692EC9F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48pd-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD715BDD-7C74-4785-BEDF-75918F6FB37A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48pq-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CD10664-94D0-48C0-92EF-E8EA66841245",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48pq-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "071A47F9-FF35-4F2C-BF5D-897CAC8BC08A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48pq-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E988448-36C9-47E0-9356-DA400EB824E3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48ps-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D067EF9-00DB-4979-B12E-55749059A083",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48ps-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9FA300A-44B1-44EE-8111-C1296EB0B638",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48ps-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8598A543-B30B-4BD4-9974-F432FFFDCDD7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48td-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "48DEBBAD-D28D-4784-BBD8-9FAD1710A919",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48td-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A5FC516-6B48-4D77-B26D-FA097AC91D1A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48td-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A7437E4-5C09-436C-AFBC-F6B6747A4339",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48tq-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECBC0277-4990-4DE7-AD80-20E8A6F561D2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48tq-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E7DAF69-662B-4999-A6AD-AA528B53EAF7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48tq-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2DF90C70-A2B8-44A4-B4A1-2A1B48AA9D0A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48ts-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D28306B1-3DDE-4444-9784-522B3D2163EE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48ts-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9257D187-1F2D-40F4-8C87-78978DB56C3F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-48ts-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BF4A033-FD9E-4B98-A0FD-CF6CD9BD3E5B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-8x24pd-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4AF8261-74E0-4F53-B82C-A7BA7559D7CB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-8x24pd-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "25AE251E-E99F-4546-85B0-C57834B040B7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-8x24pd-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C62FFCB9-4253-459B-9298-C252DA9177DB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-8x24uq-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B4C0250-DA0D-4CEE-99F4-C211163C6653",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-8x24uq-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E18C436-AC70-4E2E-8ED2-EEADFCE36CB2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3650-8x24uq-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D453BF6-AB9F-4D47-B4DF-C25C67358FFE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-12s-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C2A8413-DF92-4690-8BC1-A21001BDF76B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-12s-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "882B8D8F-E154-45C3-BB47-5353167C9776",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-12xs-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A54B4EB4-EB41-4522-B7AB-C30F96099EA3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-12xs-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EAD7BE51-0BA6-4750-B274-A6E33D32B484",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-16xs-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5B6123E-B86F-4EC8-95D6-4CE47A7D0AC2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-16xs-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2305B8A-B8F2-4AF4-A86A-EFF11541D62D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24p-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "44C3EF8E-DF88-46DC-8E06-B009F346D1D2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24p-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E87F823-D924-4718-AD81-248A6C619531",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24pw-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCAC93E0-F982-4E37-866E-43B7BC5AC82E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24s-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FC866C9-BB98-4320-9FFA-F0960C560DA6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24s-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "79FB0F3E-BB66-47BB-A59F-2D4C123F9CBE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24t-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C3AD7495-3DA2-4596-9620-CD36D7C561AC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24t-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E492F3F8-4188-41E4-9A84-5E30C4AC3378",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24t-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "718F2FDC-9EA4-4C4C-8821-B15E56AF8101",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24u-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC04072A-9BBE-4A9D-AE39-054D93E0C6D8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24u-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E45BCCD0-65BB-431F-B448-221C1595CD92",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24u-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F33BA722-0680-4074-8D03-41657F8CDCC7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24xs-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "431570C7-74A1-4F7E-8FD0-690AEF0F823B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24xs-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5D22E15-E1E8-4115-A55F-5743CA9C5947",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24xu-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B240B20-CF48-4A72-9653-9D04D59C1391",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24xu-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "19D6AC73-67C9-4FA2-A361-FF08B0E3AF47",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-24xu-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "58430463-EA77-4DC9-ACDE-4DCF92CA2FC7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-32xs-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "74CCD143-3D6E-4880-B275-ECF5B04238C6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-32xs-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0D3784F-C572-4A6F-83B9-BCF64D339BC9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48f-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E09C466B-CE87-4A57-B40B-88C94BAAF36B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48f-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D58FF034-8E07-4518-A858-5F16F22217E5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48f-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "376AD386-373D-4B24-966F-D11F76C9020F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48p-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2280CAA3-03F6-4168-8E50-A6B7132A3B0E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48p-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E0C1174-C789-4547-9899-F7FCD0905F92",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48p-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC366801-655A-403B-ACD9-3BB43802A3C5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48pw-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF5463D0-A8D3-43EC-8CFF-F659A8C84436",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48t-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BD50BB2-BFD8-42F2-8C23-0D95187B01F2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48t-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "05D4D7E4-B195-46D8-8A6B-6AA4B8357618",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48t-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "39600E51-4A21-4E5B-9FF9-E7C00AE86646",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48u-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B13D6D50-D0FA-4527-BED3-52560DDD5253",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48u-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "965BF315-D833-4711-97FC-512151113367",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48u-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A0ADEBE-3DA2-4850-8115-0AC937FB0A94",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48xs-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "04072C0F-78A2-4D10-87B2-52DC2537BA89",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48xs-f-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD5C080E-D5C4-47B2-A46C-4EB3051C5221",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48xs-f-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "41CEBEE0-DA67-4EE5-9BCF-263843053A8F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_3850-48xs-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD262F58-C47F-439E-A9FF-D1C60120D306",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_9200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC4A5C56-0D08-4423-AEBD-33EDF172FCF9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_9200cx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7670A322-31C2-4A8A-86E9-09D63C52E4C2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_9200l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D6376BE-3A69-469C-B6A9-2EFB55A3B87F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_9300:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0972076B-5C87-44B3-90EC-4C200B89318A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_9300l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2FF888F-46F5-4A79-BB88-BB2EC2D27E24",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_9300lm:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA0DBB2E-DB15-47E1-B8F2-3AC0B1197C5F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_9300x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F168FB20-0C44-4A5B-910A-04B9517545C2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_9400:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "737F22AB-C5A9-4A18-BA3D-38A222491397",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_9500:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "176ACF88-6112-4179-8492-50C50577B300",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_9500h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D07FC868-0B38-4F24-BA40-87966FF80AB7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_9600:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C19A801D-02D7-40B0-88E8-FE7BA8630E60",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_9600x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D4035136-CC10-4DDD-92AF-9DC41D19CF8A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c3850-12x48u-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B9D6819-2CFC-428A-8C51-F0D4C55D5B29",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c3850-12x48u-l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3ECDFFB-DAD1-4BF6-85E1-1E8F94F991EA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c3850-12x48u-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F80AC0C7-6E96-4A72-B330-33BAF004B4C6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:meraki_ms390_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B919AAC3-CEA0-4630-9210-78EE450B8EE6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:meraki_ms390:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3D1B8918-613E-4D0D-8BEF-9FE3865D2857",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:meraki_ms210_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "50F86FE4-5EAC-4D9B-8E52-7BD4B5909F02",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:meraki_ms210:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D40A1C93-507F-4FA7-AD7A-E6E67CF9AC6F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:meraki_ms225_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9102DB4-7AEB-4926-A151-5469FAD6FC3A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:meraki_ms225:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C47A676-04AE-4CB1-AB31-5CE1F6E59333",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:meraki_ms250_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E25B538-16F2-463C-83F1-FA1EB1AAFD87",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:meraki_ms250:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6EA179B2-2D4C-4994-98EA-11CCBC4EF622",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:meraki_ms350_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8291EE73-F2E4-4C4B-B69B-C29DB9E24892",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:meraki_ms350:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBA4F22D-8631-4B7B-8861-E44B47E71DF8",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:meraki_ms355_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9930F2E5-66C5-40F7-8F32-7DEAC2245D20",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:meraki_ms355:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2CCE488C-CEDC-4DE4-9349-81D43BB85397",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:meraki_ms410_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09530D87-2A9B-4C02-99BF-546A9BDC3614",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:meraki_ms410:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "18ED32BC-BC76-4292-BF28-57F4B2468800",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:meraki_ms420_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6FA528A5-98AE-4D15-B882-B28D0D020E26",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:meraki_ms420:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC58FCD2-16FA-41BD-B6F8-58DE14B1CD62",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:meraki_ms425_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D857F3F3-151C-459E-9608-3A3AC57B4733",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:meraki_ms425:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2504A129-8A6F-4D80-82EF-3035B3E08F42",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:meraki_ms450_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "594E31F9-B62E-4A24-B549-B3436DC0AEF3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:meraki_ms450:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "63B7DA2E-84E9-459B-9DFC-4EA0EB01AA8A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_93180yc-ex_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "55D855A0-2EBD-4CD2-AB26-6C7243B958DC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_93180yc-ex:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F70D81F1-8B12-4474-9060-B4934D8A3873",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_93180yc-fx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "29D9D122-9F89-4C06-AC35-37A7E3333865",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_93180yc-fx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7349D69B-D8FA-4462-AA28-69DD18A652D9",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_93180yc-fx3_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "A14B9C34-DDBF-49D9-97C1-CDD217A3D72F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_93180yc-fx3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0D30D52-837F-4FDA-B8E5-A9066E9C6D2F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_93240yc-fx2_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "CE6B72C3-C42A-4179-B321-A459A42CE627",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_93240yc-fx2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "91231DC6-2773-4238-8C14-A346F213B5E5",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_93360yc-fx2_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "A7AAE3AF-8427-47DE-9ACD-B4A2C244606F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_93360yc-fx2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C45A38D6-BED6-4FEF-AD87-A1E813695DE0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_93120tx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "7084599E-D065-42A3-A3BF-B8EA4F6B89C9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_93120tx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "07DE6F63-2C7D-415B-8C34-01EC05C062F3",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_93108tc-ex_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "F1A3F9A1-EB93-4796-B5FB-1587DF7F3FF6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_93108tc-ex:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A90184B3-C82F-4CE5-B2AD-97D5E4690871",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9348gc-fxp_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "015CE283-86B8-4C29-BDC2-23F67984F837",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9348gc-fxp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "17C7E3DB-8E1A-47AD-B1C5-61747DC0CFB9",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_93108tc-fx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "65AEE205-266D-41B3-9D0C-B4E96F09D432",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_93108tc-fx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AB89849-6DA4-4C9D-BC3F-EE0E41FD1901",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_93108tc-fx3p_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "0D6A9925-429B-44EF-B5A6-5CAC6B1F1637",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_93108tc-fx3p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBEF7F26-BB47-44BD-872E-130820557C23",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_93216tc-fx2_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "C50CDA74-1CE0-45E7-9A1F-327451B86591",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_93216tc-fx2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B1CC5F78-E88B-4B82-9E3E-C73D3A49DE26",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-c9316d-gx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "719D9AF6-B13F-483A-A7AD-421A6047373A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-c9316d-gx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "122E24C3-1411-46DA-92F1-635BC0784559",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-c93600cd-gx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "407EB616-E9E1-439C-BF59-8458B2FD942B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-c93600cd-gx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2D5229B-AFB2-4B28-95BB-563DBC346982",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-c9332d-gx2b_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "1852EFBC-5EB1-4C06-84E3-F5F4C8583FB3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-c9332d-gx2b:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "50FE8720-EA9D-47CF-9CDB-CC09FBDD008C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-c9348d-gx2a_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "DB3D3CA0-C643-4579-A7EE-42C687B998FF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-c9348d-gx2a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D100815-C171-46F4-B675-64E20D8C4FD0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-c9364d-gx2a_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "52011CF6-67F9-4C51-BDD1-6E0101943120",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-c9364d-gx2a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F0AC2DC-234F-48BA-BCC8-DE82C293C273",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-x97160yc-ex_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "EB39C9A4-E6A5-4E87-A8AD-12A444440775",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-x97160yc-ex:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "04A26215-DEB3-4337-AFE0-5E23C760060D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-x9788tc-fx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "DC11A2D5-D2DC-49FF-8328-3E2BCA786B9F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-x9788tc-fx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BFAAE41-AD17-4F69-9029-8DD90D824E6F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-x9564px_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "29C01C7F-E40E-4E68-95F7-1566A2A70881",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-x9564px:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C63F63AD-94EC-4A6D-92AF-7FBF6275746A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-x9464px_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "88319D8D-E03D-4240-9738-5CA743CB83C4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-x9464px:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "19BCB669-5CC8-4C67-B34C-3F5ADDD4C232",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-x9564tx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "793014D8-8EDD-4E73-ABCD-D506976E5BC2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-x9564tx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "490EAB88-A0F3-4A88-9A81-B414CE78B34B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-x9464tx2_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "0CA9E2C4-E32D-4BCE-B00C-CF43EE735F36",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-x9464tx2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5E693D2-F1D5-4D22-885B-AE853221ABA9",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9636pq_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "B32F2A81-A1CA-44E5-BD09-60E5C58CA8D1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9636pq:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE340E4C-DC48-4FC8-921B-EE304DB5AE0A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_x9636q-r_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "E92FE7DE-5D45-4C0B-AF6E-C9BC19CAEC86",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_x9636q-r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8185A31C-B4F8-4F2E-9013-860443D4B4ED",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9536pq_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "E920AB2C-F7B7-400A-9E50-35D7EA0BCA22",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9536pq:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "163743A1-09E7-4EC5-8ECA-79E4B9CE173B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9432pq_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "6D674C14-16F3-4C0B-973A-39BB43D1C3DA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9432pq:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FDA8E1F0-74A6-4725-B6AA-A1112EFC5D0C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9736pq_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "451C9330-7612-4BE8-9DE2-ED089070F734",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9736pq:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "85E1D224-4751-4233-A127-A041068C804A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-x9736c-fx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "6D25F153-779D-48C6-8CAF-819ACB83672D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-x9736c-fx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC0082AD-1EFB-4AFE-9974-EAAB926553F3",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-x9732c-ex_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "2C1510E1-7DF0-43F1-9133-CE1DA75E4222",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-x9732c-ex:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B8F7177-147E-47C0-ADFB-4CD0768D52CD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-x9732c-fx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "09C94B64-0E8D-494E-B455-77AB30C65730",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-x9732c-fx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "06A72F9F-773A-463D-8BEB-6B316DF21CFD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-x9736c-ex_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "71102704-5151-4E13-996A-E7CE7A0E9E4A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-x9736c-ex:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FC94E7D-84AF-4D2A-85A7-264CED2D107B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-x9636c-rx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "25675CFC-6280-46F7-A081-1D32F138491B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-x9636c-rx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6782DA1-5568-410D-86E6-2C2B909693DD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-x9636c-r_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "156CB715-3590-4299-BCB9-80A65014E2FB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-x9636c-r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A9CE53D-E8B7-46CD-9B8B-C746A2524BA8",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:n9k-x9432c-s_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "52BECCBF-19E7-4547-9DB5-54A136DD1125",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:n9k-x9432c-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "082A5A44-DC9A-4B48-8F28-1D0EC7F82410",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9716d-gx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "9C0FCD6C-04E1-4A50-9E47-069359FE8AA1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9716d-gx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C367BBE0-D71F-4CB5-B50E-72B033E73FE1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9504_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "0809ADB7-1B8B-4416-92E3-9B18DCB78ADC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9504:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "768BE390-5ED5-48A7-9E80-C4DE8BA979B1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9508_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "B732A710-1AC6-4AFC-AECE-DB048C880E30",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9508:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DDC2F709-AFBE-48EA-A3A2-DA1134534FB6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9516_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "46246451-6D15-44C6-806B-6FB4A3222ED0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9516:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E02DC82-0D26-436F-BA64-73C958932B0A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_92160yc-x_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "DC0A9F6B-A27E-4E4F-8649-EEA2D6D17647",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_92160yc-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4283E433-7F8C-4410-B565-471415445811",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9272q_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "BE28F819-5BF0-42D7-B71D-8027F0AF3178",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9272q:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E663DE91-C86D-48DC-B771-FA72A8DF7A7C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_92304qc_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "14291E63-E393-4FFD-BA53-FD8E0B66CAEC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_92304qc:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5B2E4C1-2627-4B9D-8E92-4B483F647651",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9236c_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "7F22FED0-AE94-467A-AA36-4DD521DB7B47",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9236c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "11411BFD-3F4D-4309-AB35-A3629A360FB0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_92300yc_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "48FAAA00-BBB5-4535-A65B-A36DD684C42B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_92300yc:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F80AB6FB-32FD-43D7-A9F1-80FA47696210",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_92348gc-x_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "C842FA94-0E09-4904-8244-D8C08C4A223B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_92348gc-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "557ED31C-C26A-4FAE-8B14-D06B49F7F08B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9364c_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "9FFC8FCA-E86B-409F-A6E5-3A8D69FB1D0D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9364c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "63842B25-8C32-4988-BBBD-61E9CB09B4F3",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9336c-fx2_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "EBF2FF06-CC6A-49AE-B3B6-165351F97DBE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9336c-fx2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1FC2B1F-232E-4754-8076-CC82F3648730",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9336c-fx2-e_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "913A387B-E73C-4239-92D1-2A4519CCC21B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9336c-fx2-e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7CDD27C9-5EAF-4956-8AB7-740C84C9D4FC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9332c_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "E24104D6-70E1-4116-8092-92B7F986A856",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9332c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2DF88547-BAF4-47B0-9F60-80A30297FCEB",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9364c-gx_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "9002758D-C115-4919-8A52-52871D876509",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9364c-gx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "68EA1FEF-B6B6-49FE-A0A4-5387F76303F8",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nexus_9800_firmware:9.3\\(5\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "A10726DB-EDFE-414A-969D-BDB0B1A3DB3B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:nexus_9800:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD31B075-01B1-429E-83F4-B999356A0EB9",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sf500-24_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "49971EBA-D997-4FEF-996D-DEF844AD832C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sf500-24:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6C0F8958-8059-411B-86C8-40B1073C80C6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sf-500-24mp_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "344D4555-2AE6-4F58-B394-AFA7B6ABC161",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sf-500-24mp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "059C8B47-A6A6-46F7-A263-416A02ECD6AA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sf500-24p_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "810A431F-9066-44E4-ADC7-5B3A91A6207D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sf500-24p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "218D6018-551C-46B8-AE27-F88E6052F37B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sf500-48_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B381EE4-D6C9-4E3B-969B-F550DFA5C84F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sf500-48:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EAB8DE78-E398-458B-98EF-EEEB6E219BAB",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sf500-48mp_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "26E8BCC3-67EE-453B-A586-65314F138491",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sf500-48mp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6E049B2-C818-4929-8DDA-3B38BF8C7B3A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sf500-18p_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "47ECEB46-5C83-46B7-960B-9F9AFCD7E15A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sf500-18p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8D5F71B-7AB2-4882-9252-C282C0DD35C2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg500-28_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "5FFD059F-5379-4844-A214-52FD5844184C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg500-28:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0779C5EE-C145-4C28-8F60-EE692409102D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg500-28mpp_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7BCDDBD-EDEC-435F-ABEE-A9724D8FAEE8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg500-28mpp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BA6035EA-0F55-4C76-9E2F-DD4938576D1A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg500-28p_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7C03632-ABD9-4877-85B7-6B943E8B3F6A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg500-28p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF4D4AD6-C5FD-40D8-B002-2B784EC88B89",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg500-52_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "A54BB66E-3EBB-42E4-84A1-4A9D9C8D0813",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg500-52:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "40273E59-7C60-4094-B9FC-A633A2F23E61",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg500-52mp_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A37CB09-F576-4ABE-863A-64752B774B20",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg500-52mp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "36E534B2-12EA-489B-A939-4F1965B5EC66",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg500-52p_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "12265631-3FB7-4DF3-8220-62C77BA56271",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg500-52p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "14A201E5-0603-4C96-8F4B-87934B7B99D7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg500x-24_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9EFB960-C702-43F2-A8CD-CE042FE5AFC6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg500x-24:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1A9D4D4-EF09-4862-B62A-94913AEFA2BE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg500x-24mpp_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "A040A1FB-23FA-4B18-A3BD-B73BD60E8A38",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg500x-24mpp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1280ABD-C15B-42BF-AF72-B54C3BCBAF83",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg500x-24p_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "26D3BC96-E278-42CA-8D5C-356858249326",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg500x-24p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0093FE2A-3D4C-4435-AE35-D213C9700771",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg500x-48_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B1ED2CD-E400-45F4-B201-837318ED8A1C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg500x-48:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B84D71EE-64CC-4966-98D1-C0697816120A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg500x-48mpp_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "454DCCE3-621C-4E87-9EBA-2CC2470C2ED9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg500x-48mpp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "626915FA-9BBA-4488-944A-8B4AB12F875C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg500x-48p_firmware:3.0.0.61:*:*:*:*:*:*:*",
              "matchCriteriaId": "75AC67BF-81AD-4D23-A286-DA29D97E5B65",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg500x-48p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E99C3C2-0B98-4108-8102-80132BF47A32",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers."
    },
    {
      "lang": "es",
      "value": "Las capacidades de filtrado de la red de capa 2, como la protecci\u00f3n IPv6 RA o la inspecci\u00f3n ARP, pueden omitirse usando combinaciones de encabezados VLAN 0 y encabezados LLC/SNAP"
    }
  ],
  "id": "CVE-2021-27853",
  "lastModified": "2024-11-21T05:58:38.377",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-09-27T18:15:09.527",
  "references": [
    {
      "source": "cret@cert.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://blog.champtar.fr/VLAN0_LLC_SNAP/"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://kb.cert.org/vuls/id/855201"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://standards.ieee.org/ieee/802.1Q/10323/"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://standards.ieee.org/ieee/802.2/1048/"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://blog.champtar.fr/VLAN0_LLC_SNAP/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://kb.cert.org/vuls/id/855201"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://standards.ieee.org/ieee/802.1Q/10323/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://standards.ieee.org/ieee/802.2/1048/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ],
      "source": "cret@cert.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}