CVE-2021-27861

L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengths

State: Published
Severity: 4.7 Medium
Published: Sep 27, 2022
Updated: Nov 4, 2025
Reserved: Mar 1, 2021

Description

Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers)

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N	CISA-ADP

Weaknesses

CWE-130 Improper Handling of Length Parameter
CWE-290 Authentication Bypass by Spoofing

Affected Products

Product	Versions
802.2IEEE	802.2h-1997 through 802.2h-1997Affected
draft-ietf-v6ops-ra-guardIETF	08 through 08Affected
P802.1QIETF	D1.0 through D1.0Affected

References

https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/
https://standards.ieee.org/ieee/802.2/1048/
https://standards.ieee.org/ieee/802.1Q/10323/
https://kb.cert.org/vuls/id/855201
https://blog.champtar.fr/VLAN0_LLC_SNAP/
https://www.kb.cert.org/vuls/id/855201

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.