{"id":"CVE-2021-27853","aliases":["EUVD-2021-14591","GHSA-v8jg-p3fp-g968"],"status":"published","title":"L2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers","description":"Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00813,"percentile":0.5743,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-290"],"published":"2022-09-27T17:55:09Z","modified":"2026-06-17T03:45:31Z","products":[{"vendor":"cisco","product":"catalyst_6503-e_firmware"},{"vendor":"cisco","product":"catalyst_6504-e_firmware"},{"vendor":"cisco","product":"catalyst_6506-e_firmware"},{"vendor":"cisco","product":"catalyst_6509-e_firmware"},{"vendor":"cisco","product":"catalyst_6509-neb-a_firmware"},{"vendor":"cisco","product":"catalyst_6509-v-e_firmware"},{"vendor":"cisco","product":"catalyst_6513-e_firmware"},{"vendor":"cisco","product":"catalyst_6800ia_firmware"},{"vendor":"cisco","product":"catalyst_6807-xl_firmware"},{"vendor":"cisco","product":"catalyst_6840-x_firmware"},{"vendor":"cisco","product":"catalyst_6880-x_firmware"},{"vendor":"cisco","product":"catalyst_c6816-x-le_firmware"},{"vendor":"cisco","product":"catalyst_c6824-x-le-40g_firmware"},{"vendor":"cisco","product":"catalyst_c6832-x-le_firmware"},{"vendor":"cisco","product":"catalyst_c6840-x-le-40g_firmware"},{"vendor":"cisco","product":"ios_xe"},{"vendor":"cisco","product":"meraki_ms210_firmware"},{"vendor":"cisco","product":"meraki_ms225_firmware"},{"vendor":"cisco","product":"meraki_ms250_firmware"},{"vendor":"cisco","product":"meraki_ms350_firmware"},{"vendor":"cisco","product":"meraki_ms355_firmware"},{"vendor":"cisco","product":"meraki_ms390_firmware"},{"vendor":"cisco","product":"meraki_ms410_firmware"},{"vendor":"cisco","product":"meraki_ms420_firmware"},{"vendor":"cisco","product":"meraki_ms425_firmware"},{"vendor":"cisco","product":"meraki_ms450_firmware"},{"vendor":"cisco","product":"n9k-c9316d-gx_firmware"},{"vendor":"cisco","product":"n9k-c9332d-gx2b_firmware"},{"vendor":"cisco","product":"n9k-c9348d-gx2a_firmware"},{"vendor":"cisco","product":"n9k-c93600cd-gx_firmware"},{"vendor":"cisco","product":"n9k-c9364d-gx2a_firmware"},{"vendor":"cisco","product":"n9k-x9432c-s_firmware"},{"vendor":"cisco","product":"n9k-x9464px_firmware"},{"vendor":"cisco","product":"n9k-x9464tx2_firmware"},{"vendor":"cisco","product":"n9k-x9564px_firmware"},{"vendor":"cisco","product":"n9k-x9564tx_firmware"},{"vendor":"cisco","product":"n9k-x9636c-r_firmware"},{"vendor":"cisco","product":"n9k-x9636c-rx_firmware"},{"vendor":"cisco","product":"n9k-x97160yc-ex_firmware"},{"vendor":"cisco","product":"n9k-x9732c-ex_firmware"},{"vendor":"cisco","product":"n9k-x9732c-fx_firmware"},{"vendor":"cisco","product":"n9k-x9736c-ex_firmware"},{"vendor":"cisco","product":"n9k-x9736c-fx_firmware"},{"vendor":"cisco","product":"n9k-x9788tc-fx_firmware"},{"vendor":"cisco","product":"nexus_92160yc-x_firmware"},{"vendor":"cisco","product":"nexus_92300yc_firmware"},{"vendor":"cisco","product":"nexus_92304qc_firmware"},{"vendor":"cisco","product":"nexus_92348gc-x_firmware"},{"vendor":"cisco","product":"nexus_9236c_firmware"},{"vendor":"cisco","product":"nexus_9272q_firmware"},{"vendor":"cisco","product":"nexus_93108tc-ex_firmware"},{"vendor":"cisco","product":"nexus_93108tc-fx3p_firmware"},{"vendor":"cisco","product":"nexus_93108tc-fx_firmware"},{"vendor":"cisco","product":"nexus_93120tx_firmware"},{"vendor":"cisco","product":"nexus_93180yc-ex_firmware"},{"vendor":"cisco","product":"nexus_93180yc-fx3_firmware"},{"vendor":"cisco","product":"nexus_93180yc-fx_firmware"},{"vendor":"cisco","product":"nexus_93216tc-fx2_firmware"},{"vendor":"cisco","product":"nexus_93240yc-fx2_firmware"},{"vendor":"cisco","product":"nexus_9332c_firmware"},{"vendor":"cisco","product":"nexus_93360yc-fx2_firmware"},{"vendor":"cisco","product":"nexus_9336c-fx2-e_firmware"},{"vendor":"cisco","product":"nexus_9336c-fx2_firmware"},{"vendor":"cisco","product":"nexus_9348gc-fxp_firmware"},{"vendor":"cisco","product":"nexus_9364c-gx_firmware"},{"vendor":"cisco","product":"nexus_9364c_firmware"},{"vendor":"cisco","product":"nexus_9432pq_firmware"},{"vendor":"cisco","product":"nexus_9504_firmware"},{"vendor":"cisco","product":"nexus_9508_firmware"},{"vendor":"cisco","product":"nexus_9516_firmware"},{"vendor":"cisco","product":"nexus_9536pq_firmware"},{"vendor":"cisco","product":"nexus_9636pq_firmware"},{"vendor":"cisco","product":"nexus_9716d-gx_firmware"},{"vendor":"cisco","product":"nexus_9736pq_firmware"},{"vendor":"cisco","product":"nexus_9800_firmware"},{"vendor":"cisco","product":"nexus_x9636q-r_firmware"},{"vendor":"cisco","product":"sf-500-24mp_firmware"},{"vendor":"cisco","product":"sf500-18p_firmware"},{"vendor":"cisco","product":"sf500-24_firmware"},{"vendor":"cisco","product":"sf500-24p_firmware"},{"vendor":"cisco","product":"sf500-48_firmware"},{"vendor":"cisco","product":"sf500-48mp_firmware"},{"vendor":"cisco","product":"sg500-28_firmware"},{"vendor":"cisco","product":"sg500-28mpp_firmware"},{"vendor":"cisco","product":"sg500-28p_firmware"},{"vendor":"cisco","product":"sg500-52_firmware"},{"vendor":"cisco","product":"sg500-52mp_firmware"},{"vendor":"cisco","product":"sg500-52p_firmware"},{"vendor":"cisco","product":"sg500x-24_firmware"},{"vendor":"cisco","product":"sg500x-24mpp_firmware"},{"vendor":"cisco","product":"sg500x-24p_firmware"},{"vendor":"cisco","product":"sg500x-48_firmware"},{"vendor":"cisco","product":"sg500x-48mpp_firmware"},{"vendor":"cisco","product":"sg500x-48p_firmware"},{"vendor":"ieee","product":"802.2"},{"vendor":"ieee","product":"ieee_802.2"},{"vendor":"ietf","product":"draft-ietf-v6ops-ra-guard"},{"vendor":"ietf","product":"p802.1q"}],"references":[{"url":"https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/","tags":["x_transferred","Technical Description","Third Party Advisory"]},{"url":"https://standards.ieee.org/ieee/802.2/1048/","tags":["x_transferred","Vendor Advisory"]},{"url":"https://standards.ieee.org/ieee/802.1Q/10323/","tags":["x_transferred","Vendor Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX","tags":["vendor-advisory","x_transferred","Third Party Advisory"]},{"url":"https://kb.cert.org/vuls/id/855201","tags":["x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://blog.champtar.fr/VLAN0_LLC_SNAP/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/855201"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27853"},{"url":"https://blog.champtar.fr/VLAN0_LLC_SNAP"},{"url":"https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08"},{"url":"https://standards.ieee.org/ieee/802.1Q/10323"},{"url":"https://standards.ieee.org/ieee/802.2/1048"},{"url":"https://github.com/advisories/GHSA-v8jg-p3fp-g968"}],"sources":{"cve":[{"id":"CVE-2021-27853","title":"L2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers","description":"Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.","status":"published","published":"2022-09-27T17:55:09.203Z","modified":"2025-11-04T19:12:25.432Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:33:04.360272Z"}],"euvd":[{"id":"EUVD-2021-14591","description":"Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.","status":"published","published":"2022-09-27T17:55:09Z","modified":"2025-11-04T19:12:25Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:23.324829Z"}],"ghsa":[{"id":"GHSA-v8jg-p3fp-g968","title":"Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed...","description":"Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.","status":"published","published":"2022-09-28T00:00:18Z","modified":"2025-11-04T21:31:31Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:04:37.024156Z"}],"nvd":[{"id":"CVE-2021-27853","description":"Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.","status":"published","published":"2022-09-27T18:15:09.527Z","modified":"2026-06-17T03:45:31.153Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:07:06.906968Z"}]}}