Is CVE-2021-34770 actively exploited?

No active exploitation of CVE-2021-34770 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-34770 be exploited remotely?

Yes. CVE-2021-34770 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-34770?

CVE-2021-34770 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2021-34770

CRITICAL

CVE-2021-34770

CWE-122Published: September 23, 2021· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated, remote attacker to execute arbitrary code with administrative privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a logic error that occurs during the validation of CAPWAP packets. An attacker could exploit this vulnerability by sending a crafted CAPWAP packet to an affected device. A successful exploit could allow the attacker to execute arbitrary code with administrative privileges or cause the affected device to crash and reload, resulting in a DoS condition.

NVD Source

Technical Analysis

CVE-2021-34770 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

Cisco11 product(s)

ios xecatalyst 9800catalyst 9800-40catalyst 9800-40 wireless controllercatalyst 9800-80catalyst 9800-80 wireless controllercatalyst 9800-clcatalyst 9800-lcatalyst 9800-l-ccatalyst 9800-l-fcatalyst 9800 embedded wireless controller

Source: NVD CPE · 39 total CPE entries