CVE-2021-27861 - Vulnerability Details - OpenCVE

Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers)

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ieee	Ieee 802.2
Ietf	P802.1q

Configuration 1 [-]

cpe:2.3:a:ieee:ieee_802.2:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:a:ietf:p802.1q:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://blog.champtar.fr/VLAN0_LLC_SNAP/
https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/
https://kb.cert.org/vuls/id/855201
https://nvd.nist.gov/vuln/detail/CVE-2021-27861
https://standards.ieee.org/ieee/802.1Q/10323/
https://standards.ieee.org/ieee/802.2/1048/
https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-VU855201-J3z8CKTX.html
https://www.cve.org/CVERecord?id=CVE-2021-27861
https://www.kb.cert.org/vuls/id/855201

History

Tue, 04 Nov 2025 20:30:00 +0000

Type	Values Removed	Values Added
References		https://www.kb.cert.org/vuls/id/855201

Wed, 21 May 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2022-09-27T18:40:13.742Z

Updated: 2025-11-04T19:12:27.712Z

Reserved: 2021-03-01T00:00:00.000Z

Link: CVE-2021-27861

Vulnrichment

Updated: 2025-11-04T19:12:27.712Z

NVD

Status : Modified

Published: 2022-09-27T19:15:09.330

Modified: 2025-11-04T20:15:59.903

Link: CVE-2021-27861

Redhat

Severity : Moderate

Publid Date: 2022-09-27T10:30:00Z

Links: CVE-2021-27861 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-27861", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "assignerShortName": "certcc", "datePublished": "2022-09-27T18:40:13.742Z", "dateUpdated": "2025-11-04T19:12:27.712Z", "dateReserved": "2021-03-01T00:00:00.000Z"}, "containers": {"cna": {"title": "L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengths", "datePublic": "2022-09-27T00:00:00.000Z", "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2022-10-12T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers)"}], "affected": [{"vendor": "IEEE", "product": "802.2", "versions": [{"version": "802.2h-1997", "status": "affected", "lessThanOrEqual": "802.2h-1997", "versionType": "custom"}]}, {"vendor": "IETF", "product": "draft-ietf-v6ops-ra-guard", "versions": [{"version": "08", "status": "affected", "lessThanOrEqual": "08", "versionType": "custom"}]}, {"vendor": "IETF", "product": "P802.1Q", "versions": [{"version": "D1.0", "status": "affected", "lessThanOrEqual": "D1.0", "versionType": "custom"}]}], "references": [{"url": "https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/"}, {"url": "https://standards.ieee.org/ieee/802.2/1048/"}, {"url": "https://standards.ieee.org/ieee/802.1Q/10323/"}, {"url": "https://kb.cert.org/vuls/id/855201"}, {"url": "https://blog.champtar.fr/VLAN0_LLC_SNAP/"}], "credits": [{"lang": "en", "value": "Etienne Champetier (@champtar) <champetier.etienne@gmail.com>"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-130 Improper Handling of Length Parameter", "cweId": "CWE-130"}]}, {"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-290: Authentication Bypass by Spoofing", "cweId": "CWE-290"}]}], "source": {"discovery": "EXTERNAL"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/", "tags": ["x_transferred"]}, {"url": "https://standards.ieee.org/ieee/802.2/1048/", "tags": ["x_transferred"]}, {"url": "https://standards.ieee.org/ieee/802.1Q/10323/", "tags": ["x_transferred"]}, {"url": "https://kb.cert.org/vuls/id/855201", "tags": ["x_transferred"]}, {"url": "https://blog.champtar.fr/VLAN0_LLC_SNAP/", "tags": ["x_transferred"]}, {"url": "https://www.kb.cert.org/vuls/id/855201"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T19:12:27.712Z"}}, {"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-21T15:06:05.203947Z", "id": "CVE-2021-27861", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-21T15:06:11.048Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/", "tags": ["x_transferred"]}, {"url": "https://standards.ieee.org/ieee/802.2/1048/", "tags": ["x_transferred"]}, {"url": "https://standards.ieee.org/ieee/802.1Q/10323/", "tags": ["x_transferred"]}, {"url": "https://kb.cert.org/vuls/id/855201", "tags": ["x_transferred"]}, {"url": "https://blog.champtar.fr/VLAN0_LLC_SNAP/", "tags": ["x_transferred"]}, {"url": "https://www.kb.cert.org/vuls/id/855201"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T19:12:27.712Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2021-27861", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-21T15:06:05.203947Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-21T15:05:32.573Z"}}], "cna": {"title": "L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengths", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "Etienne Champetier (@champtar) <champetier.etienne@gmail.com>"}], "affected": [{"vendor": "IEEE", "product": "802.2", "versions": [{"status": "affected", "version": "802.2h-1997", "versionType": "custom", "lessThanOrEqual": "802.2h-1997"}]}, {"vendor": "IETF", "product": "draft-ietf-v6ops-ra-guard", "versions": [{"status": "affected", "version": "08", "versionType": "custom", "lessThanOrEqual": "08"}]}, {"vendor": "IETF", "product": "P802.1Q", "versions": [{"status": "affected", "version": "D1.0", "versionType": "custom", "lessThanOrEqual": "D1.0"}]}], "datePublic": "2022-09-27T00:00:00.000Z", "references": [{"url": "https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/"}, {"url": "https://standards.ieee.org/ieee/802.2/1048/"}, {"url": "https://standards.ieee.org/ieee/802.1Q/10323/"}, {"url": "https://kb.cert.org/vuls/id/855201"}, {"url": "https://blog.champtar.fr/VLAN0_LLC_SNAP/"}], "descriptions": [{"lang": "en", "value": "Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers)"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-130", "description": "CWE-130 Improper Handling of Length Parameter"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290: Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2022-10-12T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2021-27861", "state": "PUBLISHED", "dateUpdated": "2025-11-04T19:12:27.712Z", "dateReserved": "2021-03-01T00:00:00.000Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2022-09-27T18:40:13.742Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ieee:ieee_802.2:*:*:*:*:*:*:*:*", "matchCriteriaId": "D5B0DDC2-21C5-4682-9AA2-055BF7C722DA", "versionEndIncluding": "802.2h-1997", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ietf:p802.1q:*:*:*:*:*:*:*:*", "matchCriteriaId": "94105D2E-950F-4290-8840-301FA908BC8C", "versionEndIncluding": "d1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers)"}, {"lang": "es", "value": "Las capacidades de filtrado de red de capa 2, como la protecci\u00f3n RA de IPv6, pueden omitirse usando encabezados LLC/SNAP con una longitud no v\u00e1lida (y, opcionalmente, encabezados VLAN0)"}], "id": "CVE-2021-27861", "lastModified": "2025-11-04T20:15:59.903", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-09-27T19:15:09.330", "references": [{"source": "cret@cert.org", "url": "https://blog.champtar.fr/VLAN0_LLC_SNAP/"}, {"source": "cret@cert.org", "tags": ["Third Party Advisory"], "url": "https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/"}, {"source": "cret@cert.org", "url": "https://kb.cert.org/vuls/id/855201"}, {"source": "cret@cert.org", "tags": ["Third Party Advisory"], "url": "https://standards.ieee.org/ieee/802.1Q/10323/"}, {"source": "cret@cert.org", "tags": ["Third Party Advisory"], "url": "https://standards.ieee.org/ieee/802.2/1048/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://blog.champtar.fr/VLAN0_LLC_SNAP/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://kb.cert.org/vuls/id/855201"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://standards.ieee.org/ieee/802.1Q/10323/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://standards.ieee.org/ieee/802.2/1048/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.kb.cert.org/vuls/id/855201"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-130"}, {"lang": "en", "value": "CWE-290"}], "source": "cret@cert.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-290"}], "source": "nvd@nist.gov", "type": "Primary"}]}