CVE-2021-27853
L2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers
- State
- Published
- Severity
- 4.7 Medium
- Published
- Sep 27, 2022
- Updated
- Nov 4, 2025
- Reserved
- Mar 1, 2021
Description
Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.7 Medium | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-290 Authentication Bypass by Spoofing
Affected Products
| Product | Versions |
|---|---|
802.2IEEE |
|
draft-ietf-v6ops-ra-guardIETF |
|
P802.1QIETF |
|
References
- https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/
- https://standards.ieee.org/ieee/802.2/1048/
- https://standards.ieee.org/ieee/802.1Q/10323/
- 20220927 Vulnerabilities in Layer 2 Network Security Controls Affecting Cisco Products: September 2022vendor-advisory
- https://kb.cert.org/vuls/id/855201
- https://blog.champtar.fr/VLAN0_LLC_SNAP/
- https://www.kb.cert.org/vuls/id/855201
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.