CVE-2021-44228

Published: Dec 10, 2021Modified: Jun 17, 2026CISA KEV

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: NVD

Description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Affected (372)

Products: Siemens: 6bk1602 0aa12 0tp0 Firmware, 6bk1602 0aa22 0tp0 Firmware, 6bk1602 0aa32 0tp0 Firmware, 6bk1602 0aa42 0tp0 Firmware, 6bk1602 0aa52 0tp0 Firmware, Sppa T3000 Ses3000 Firmware, Capital, Comos, Desigo Cc Advanced Reports, Desigo Cc Info Center, E Car Operation Center, Energy Engage, Energyip, Energyip Prepay, Gma Manager, Head End System Universal Device Integration System, Industrial Edge Management, Industrial Edge Management Hub, Logo! Soft Comfort, Mendix, Mindsphere, Navigator, Nx, Opcenter Intelligence, Operation Scheduler, Sentron Powermanager, Siguard Dsa, Sipass Integrated, Siveillance Command, Siveillance Control Pro, Siveillance Identity, Siveillance Vantage, Siveillance Viewpoint, Solid Edge Cam Pro, Solid Edge Harness Design, Spectrum Power 4, Spectrum Power 7, Teamcenter, Vesys, Xpedition Enterprise, Xpedition Package Integrator · Apache: Log4j · Intel: Computer Vision Annotation Tool, Datacenter Manager, Genomics Kernel Library, Oneapi Sample Browser, Secure Device Onboard, System Studio · +9 more

Show all products

Siemens: 6bk1602 0aa12 0tp0 Firmware, 6bk1602 0aa22 0tp0 Firmware, 6bk1602 0aa32 0tp0 Firmware, 6bk1602 0aa42 0tp0 Firmware, 6bk1602 0aa52 0tp0 Firmware, Sppa T3000 Ses3000 Firmware, Capital, Comos, Desigo Cc Advanced Reports, Desigo Cc Info Center, E Car Operation Center, Energy Engage, Energyip, Energyip Prepay, Gma Manager, Head End System Universal Device Integration System, Industrial Edge Management, Industrial Edge Management Hub, Logo! Soft Comfort, Mendix, Mindsphere, Navigator, Nx, Opcenter Intelligence, Operation Scheduler, Sentron Powermanager, Siguard Dsa, Sipass Integrated, Siveillance Command, Siveillance Control Pro, Siveillance Identity, Siveillance Vantage, Siveillance Viewpoint, Solid Edge Cam Pro, Solid Edge Harness Design, Spectrum Power 4, Spectrum Power 7, Teamcenter, Vesys, Xpedition Enterprise, Xpedition Package Integrator · Apache: Log4j · Intel: Computer Vision Annotation Tool, Datacenter Manager, Genomics Kernel Library, Oneapi Sample Browser, Secure Device Onboard, System Studio · Debian: Debian Linux · Fedoraproject: Fedora · Sonicwall: Email Security · Netapp: Active Iq Unified Manager, Brocade San Navigator, Cloud Insights, Cloud Manager, Cloud Secure Agent, Oncommand Insight, Ontap Tools, Snapcenter, Solidfire & Hci Storage Node, Solidfire Enterprise Sds · Cisco: Advanced Malware Protection Virtual Private Cloud Appliance, Automated Subsea Tuning, Broadworks, Business Process Automation, Cloud Connect, Cloudcenter, Cloudcenter Cost Optimizer, Cloudcenter Suite Admin, Cloudcenter Workload Manager, Common Services Platform Collector, Connected Mobile Experiences, Contact Center Domain Manager, Contact Center Management Portal, Crosswork Data Gateway, Crosswork Network Controller, Crosswork Optimization Engine, Crosswork Platform Infrastructure, Crosswork Zero Touch Provisioning, Customer Experience Cloud Agent, Cyber Vision Sensor Management Extension, Data Center Network Manager, Dna Center, Dna Spaces, Emergency Responder, Enterprise Chat And Email, Evolved Programmable Network Manager, Finesse, Fog Director, Identity Services Engine, Integrated Management Controller Supervisor, Intersight Virtual Appliance, Iot Operations Dashboard, Network Assurance Engine, Network Services Orchestrator, Nexus Dashboard, Nexus Insights, Optical Network Controller, Packaged Contact Center Enterprise, Paging Server, Prime Service Catalog, Sd Wan Vmanage, Smart Phy, Ucs Central, Ucs Director, Unified Communications Manager, Unified Communications Manager Im And Presence Service, Unified Contact Center Enterprise, Unified Contact Center Express, Unified Customer Voice Portal, Unified Intelligence Center, Unified Sip Proxy, Unified Workforce Optimization, Unity Connection, Video Surveillance Operations Manager, Virtual Topology System, Virtualized Infrastructure Manager, Virtualized Voice Browser, Wan Automation Engine, Webex Meetings Server, Workload Optimization Manager, Fxos, Cloudcenter Suite, Crosswork Network Automation, Cx Cloud Agent, Cyber Vision, Dna Spaces Connector, Firepower Threat Defense, Mobility Services Engine, Network Dashboard Fabric Controller, Network Insights For Data Center, Ucs Central Software, Unified Communications Manager Im & Presence Service, Unified Computing System, Unified Contact Center Management Portal, Video Surveillance Manager · Snowsoftware: Snow Commander, Vm Access Proxy · Bentley: Synchro, Synchro 4d · Percussion: Rhythmyx · Apple: Xcode

Siemens

41 products

6bk1602 0aa12 0tp0 Firmware

6bk1602 0aa22 0tp0 Firmware

6bk1602 0aa32 0tp0 Firmware

6bk1602 0aa42 0tp0 Firmware

6bk1602 0aa52 0tp0 Firmware

Sppa T3000 Ses3000 Firmware

Capital

Comos

Desigo Cc Advanced Reports

Desigo Cc Info Center

E Car Operation Center

Head End System Universal Device Integration System

Industrial Edge Management

Industrial Edge Management Hub

Opcenter Intelligence

Siveillance Control Pro

Siveillance Identity

Siveillance Vantage

Siveillance Viewpoint

Solid Edge Cam Pro

Solid Edge Harness Design

Xpedition Package Integrator

Apache

1 product

Log4j

Intel

6 products

Computer Vision Annotation Tool

Datacenter Manager

Genomics Kernel Library

Oneapi Sample Browser

Secure Device Onboard

1 product

1 product

1 product

10 products

Active Iq Unified Manager

Brocade San Navigator

Solidfire & Hci Storage Node

Solidfire Enterprise Sds

Cisco

75 products

Advanced Malware Protection Virtual Private Cloud Appliance

Automated Subsea Tuning

Broadworks

Business Process Automation

Cloud Connect

Cloudcenter

Cloudcenter Cost Optimizer

Cloudcenter Suite Admin

Cloudcenter Workload Manager

Common Services Platform Collector

Connected Mobile Experiences

Contact Center Domain Manager

Contact Center Management Portal

Crosswork Data Gateway

Crosswork Network Controller

Crosswork Optimization Engine

Crosswork Platform Infrastructure

Crosswork Zero Touch Provisioning

Customer Experience Cloud Agent

Cyber Vision Sensor Management Extension

Data Center Network Manager

Dna Center

Dna Spaces

Emergency Responder

Enterprise Chat And Email

Evolved Programmable Network Manager

Finesse

Fog Director

Identity Services Engine

Integrated Management Controller Supervisor

Intersight Virtual Appliance

Iot Operations Dashboard

Network Assurance Engine

Network Services Orchestrator

Nexus Dashboard

Nexus Insights

Optical Network Controller

Packaged Contact Center Enterprise

Paging Server

Prime Service Catalog

Unified Communications Manager

Unified Communications Manager Im And Presence Service

Unified Contact Center Enterprise

Unified Contact Center Express

Unified Customer Voice Portal

Unified Intelligence Center

Unified Sip Proxy

Unified Workforce Optimization

Unity Connection

Video Surveillance Operations Manager

Virtual Topology System

Virtualized Infrastructure Manager

Virtualized Voice Browser

Wan Automation Engine

Webex Meetings Server

Workload Optimization Manager

Fxos

Cloudcenter Suite

Crosswork Network Automation

Cx Cloud Agent

Cyber Vision

Dna Spaces Connector

Firepower Threat Defense

Mobility Services Engine

Network Dashboard Fabric Controller

Network Insights For Data Center

Ucs Central Software

Unified Communications Manager Im & Presence Service

Unified Computing System

Unified Contact Center Management Portal

Video Surveillance Manager

2 products

2 products

1 product

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens 6bk1602 0aa12 0tp0 Firmware	Before 2.7.0

Running on/with	Platform Versions
Siemens 6bk1602 0aa12 0tp0	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens 6bk1602 0aa22 0tp0 Firmware	Before 2.7.0

Running on/with	Platform Versions
Siemens 6bk1602 0aa22 0tp0	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens 6bk1602 0aa32 0tp0 Firmware	Before 2.7.0

Running on/with	Platform Versions
Siemens 6bk1602 0aa32 0tp0	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens 6bk1602 0aa42 0tp0 Firmware	Before 2.7.0

Running on/with	Platform Versions
Siemens 6bk1602 0aa42 0tp0	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens 6bk1602 0aa52 0tp0 Firmware	Before 2.7.0

Running on/with	Platform Versions
Siemens 6bk1602 0aa52 0tp0	All versions

Configuration F

7 vulnerable

Vulnerable Software	Affected Versions
Apache Log4j	From 2.0.1 to 2.3.1
Apache Log4j	From 2.13.0 to 2.15.0
Apache Log4j	From 2.4.0 to 2.12.2
Apache Log4j	Version 2.0
Apache Log4j	Version 2.0 beta9
Apache Log4j	Version 2.0 rc1
Apache Log4j	Version 2.0 rc2

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Sppa T3000 Ses3000 Firmware	All versions

Running on/with	Platform Versions
Siemens Sppa T3000 Ses3000	All versions

Configuration H

63 vulnerable

Vulnerable Software	Affected Versions
Siemens Capital	Before 2019.1
Siemens Capital	Version 2019.1
Siemens Capital	Version 2019.1 sp1912
Siemens Comos	Before 10.4.2
Siemens Desigo Cc Advanced Reports	Version 3.0
Siemens Desigo Cc Advanced Reports	Version 4.0
Siemens Desigo Cc Advanced Reports	Version 4.1
Siemens Desigo Cc Advanced Reports	Version 4.2
Siemens Desigo Cc Advanced Reports	Version 5.0
Siemens Desigo Cc Advanced Reports	Version 5.1
Siemens Desigo Cc Info Center	Version 5.0
Siemens Desigo Cc Info Center	Version 5.1
Siemens E Car Operation Center	Before 2021-12-13
Siemens Energy Engage	Version 3.1
Siemens Energyip	Version 8.5
Siemens Energyip	Version 8.6
Siemens Energyip	Version 8.7
Siemens Energyip	Version 9.0
Siemens Energyip Prepay	Before 3.8.0.12
Siemens Gma Manager	Before 8.6.2j-398
Siemens Head End System Universal Device Integration System	All versions
Siemens Industrial Edge Management	All versions
Siemens Industrial Edge Management Hub	Before 2021-12-13
Siemens Logo! Soft Comfort	All versions
Siemens Mendix	All versions
Siemens Mindsphere	Before 2021-12-16
Siemens Navigator	Before 2021-12-13
Siemens Nx	All versions
Siemens Opcenter Intelligence	From 3.2 to 3.5
Siemens Operation Scheduler	Up to 1.1.3
Siemens Sentron Powermanager	Version 4.1
Siemens Sentron Powermanager	Version 4.2
Siemens Siguard Dsa	From 4.2 to 4.4.1
Siemens Sipass Integrated	Version 2.80
Siemens Sipass Integrated	Version 2.85
Siemens Siveillance Command	Up to 4.16.2.1
Siemens Siveillance Control Pro	All versions
Siemens Siveillance Identity	Version 1.5
Siemens Siveillance Identity	Version 1.6
Siemens Siveillance Vantage	All versions
Siemens Siveillance Viewpoint	All versions
Siemens Solid Edge Cam Pro	All versions
Siemens Solid Edge Harness Design	Before 2020
Siemens Solid Edge Harness Design	Version 2020
Siemens Solid Edge Harness Design	Version 2020
Siemens Solid Edge Harness Design	Version 2020 sp2002
Siemens Spectrum Power 4	Before 4.70
Siemens Spectrum Power 4	Version 4.70
Siemens Spectrum Power 4	Version 4.70 sp7
Siemens Spectrum Power 4	Version 4.70 sp8
Siemens Spectrum Power 7	Before 2.30
Siemens Spectrum Power 7	Version 2.30
Siemens Spectrum Power 7	Version 2.30
Siemens Spectrum Power 7	Version 2.30 sp2
Siemens Teamcenter	All versions
Siemens Vesys	Before 2019.1
Siemens Vesys	Version 2019.1
Siemens Vesys	Version 2019.1
Siemens Vesys	Version 2019.1 sp1912
Siemens Vesys	Version 2020.1
Siemens Vesys	Version 2021.1
Siemens Xpedition Enterprise	All versions
Siemens Xpedition Package Integrator	All versions

Configuration I

6 vulnerable

Vulnerable Software	Affected Versions
Intel Computer Vision Annotation Tool	All versions
Intel Datacenter Manager	Before 5.1
Intel Genomics Kernel Library	All versions
Intel Oneapi Sample Browser	All versions
Intel Secure Device Onboard	All versions
Intel System Studio	All versions

Configuration J

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 9.0

Configuration K

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35

Configuration L

1 vulnerable

Vulnerable Software	Affected Versions
Sonicwall Email Security	Before 10.0.13

Configuration M

12 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Brocade San Navigator	All versions
Netapp Cloud Insights	All versions
Netapp Cloud Manager	All versions
Netapp Cloud Secure Agent	All versions
Netapp Oncommand Insight	All versions
Netapp Ontap Tools	All versions
Netapp Snapcenter	All versions
Netapp Solidfire & Hci Storage Node	All versions
Netapp Solidfire Enterprise Sds	All versions

Configuration N

104 vulnerable

Vulnerable Software	Affected Versions
Cisco Advanced Malware Protection Virtual Private Cloud Appliance	Before 3.5.4
Cisco Automated Subsea Tuning	Before 2.1.0
Cisco Broadworks	Before 2021.11_1.162
Cisco Business Process Automation	Before 3.0.000.115
Cisco Business Process Automation	From 3.1.000.000 to 3.1.000.044
Cisco Business Process Automation	From 3.2.000.000 to 3.2.000.009
Cisco Cloud Connect	Before 12.6\(1\)
Cisco Cloudcenter	Before 4.10.0.16
Cisco Cloudcenter Cost Optimizer	Before 5.5.2
Cisco Cloudcenter Suite Admin	Before 5.3.1
Cisco Cloudcenter Workload Manager	Before 5.5.2
Cisco Common Services Platform Collector	Before 2.9.1.3
Cisco Common Services Platform Collector	From 2.10.0 to 2.10.0.1
Cisco Connected Mobile Experiences	All versions
Cisco Contact Center Domain Manager	Before 12.5\(1\)
Cisco Contact Center Management Portal	Before 12.5\(1\)
Cisco Crosswork Data Gateway	Before 2.0.2
Cisco Crosswork Data Gateway	Version 3.0.0
Cisco Crosswork Network Controller	Before 2.0.1
Cisco Crosswork Network Controller	Version 3.0.0
Cisco Crosswork Optimization Engine	Before 2.0.1
Cisco Crosswork Optimization Engine	Version 3.0.0
Cisco Crosswork Platform Infrastructure	Before 4.0.1
Cisco Crosswork Platform Infrastructure	Version 4.1.0
Cisco Crosswork Zero Touch Provisioning	Before 2.0.1
Cisco Crosswork Zero Touch Provisioning	Version 3.0.0
Cisco Customer Experience Cloud Agent	Before 1.12.1
Cisco Cyber Vision Sensor Management Extension	Before 4.0.3
Cisco Data Center Network Manager	Before 11.3\(1\)
Cisco Data Center Network Manager	Version 11.3(1)
Cisco Dna Center	Before 2.1.2.8
Cisco Dna Center	From 2.2.2.0 to 2.2.2.8
Cisco Dna Center	From 2.2.3.0 to 2.2.3.4
Cisco Dna Spaces\	Before 2.5
Cisco Emergency Responder	Before 11.5\(4\)
Cisco Enterprise Chat And Email	Before 12.0\(1\)
Cisco Evolved Programmable Network Manager	Up to 4.1.1
Cisco Finesse	Before 12.6\(1\)
Cisco Finesse	Version 12.6(1)
Cisco Fog Director	All versions
Cisco Identity Services Engine	Before 2.4.0
Cisco Identity Services Engine	Version 2.4.0
Cisco Integrated Management Controller Supervisor	Before 2.3.2.1
Cisco Intersight Virtual Appliance	Before 1.0.9-361
Cisco Iot Operations Dashboard	All versions
Cisco Network Assurance Engine	Before 6.0.2
Cisco Network Services Orchestrator	Before 5.3.5.1
Cisco Network Services Orchestrator	From 5.4 to 5.4.5.2
Cisco Network Services Orchestrator	From 5.5 to 5.5.4.1
Cisco Network Services Orchestrator	From 5.6 to 5.6.3.1
Cisco Nexus Dashboard	Before 2.1.2
Cisco Nexus Insights	Before 6.0.2
Cisco Optical Network Controller	Before 1.1.0
Cisco Packaged Contact Center Enterprise	Before 11.6
Cisco Packaged Contact Center Enterprise	Version 11.6(1)
Cisco Paging Server	Before 14.4.1
Cisco Prime Service Catalog	Before 12.1
Cisco Sd Wan Vmanage	Before 20.3.4.1
Cisco Sd Wan Vmanage	From 20.4 to 20.4.2.1
Cisco Sd Wan Vmanage	From 20.5 to 20.5.1.1
Cisco Sd Wan Vmanage	From 20.6 to 20.6.2.1
Cisco Smart Phy	Before 3.2.1
Cisco Ucs Central	Before 2.0\(1p\)
Cisco Ucs Director	Before 6.8.2.0
Cisco Unified Communications Manager	Before 11.5\(1\)
Cisco Unified Communications Manager	Before 11.5\(1\)
Cisco Unified Communications Manager	Version 11.5(1)
Cisco Unified Communications Manager	Version 11.5(1)
Cisco Unified Communications Manager	Version 11.5(1)
Cisco Unified Communications Manager	Version 11.5(1)su3
Cisco Unified Communications Manager Im And Presence Service	Before 11.5\(1\)
Cisco Unified Communications Manager Im And Presence Service	Version 11.5(1)
Cisco Unified Contact Center Enterprise	Before 11.6\(2\)
Cisco Unified Contact Center Express	Before 12.5\(1\)
Cisco Unified Customer Voice Portal	Before 11.6
Cisco Unified Customer Voice Portal	Version 11.6
Cisco Unified Customer Voice Portal	Version 12.0
Cisco Unified Customer Voice Portal	Version 12.5
Cisco Unified Intelligence Center	Before 12.6\(1\)
Cisco Unified Sip Proxy	Before 10.2.1v2
Cisco Unified Workforce Optimization	Before 11.5\(1\)
Cisco Unity Connection	Before 11.5\(1\)
Cisco Video Surveillance Operations Manager	Before 7.14.4
Cisco Virtual Topology System	Before 2.6.7
Cisco Virtualized Infrastructure Manager	Before 3.2.0
Cisco Virtualized Infrastructure Manager	From 3.4.0 to 3.4.4
Cisco Virtualized Voice Browser	Before 12.5\(1\)
Cisco Wan Automation Engine	Before 7.3.0.2
Cisco Webex Meetings Server	Before 3.0
Cisco Webex Meetings Server	Version 3.0
Cisco Webex Meetings Server	Version 3.0 maintenance_release1
Cisco Webex Meetings Server	Version 3.0 maintenance_release2
Cisco Webex Meetings Server	Version 3.0 maintenance_release3
Cisco Webex Meetings Server	Version 3.0 maintenance_release3
Cisco Webex Meetings Server	Version 3.0 maintenance_release3_security_patch4
Cisco Webex Meetings Server	Version 3.0 maintenance_release3_security_patch5
Cisco Webex Meetings Server	Version 3.0 maintenance_release3_service_pack_2
Cisco Webex Meetings Server	Version 3.0 maintenance_release3_service_pack_3
Cisco Webex Meetings Server	Version 3.0 maintenance_release4
Cisco Webex Meetings Server	Version 4.0
Cisco Webex Meetings Server	Version 4.0 maintenance_release1
Cisco Webex Meetings Server	Version 4.0 maintenance_release2
Cisco Webex Meetings Server	Version 4.0 maintenance_release3
Cisco Workload Optimization Manager	Before 3.2.1

Configuration O

8 vulnerable · 17 platform

Vulnerable Software	Affected Versions
Cisco Fxos	Version 6.2.3
Cisco Fxos	Version 6.3.0
Cisco Fxos	Version 6.4.0
Cisco Fxos	Version 6.5.0
Cisco Fxos	Version 6.6.0
Cisco Fxos	Version 6.7.0
Cisco Fxos	Version 7.0.0
Cisco Fxos	Version 7.1.0

Running on/with	Platform Versions
Cisco Firepower 1010	All versions
Cisco Firepower 1120	All versions
Cisco Firepower 1140	All versions
Cisco Firepower 1150	All versions
Cisco Firepower 2110	All versions
Cisco Firepower 2120	All versions
Cisco Firepower 2130	All versions
Cisco Firepower 2140	All versions
Cisco Firepower 4110	All versions
Cisco Firepower 4112	All versions
Cisco Firepower 4115	All versions
Cisco Firepower 4120	All versions
Cisco Firepower 4125	All versions
Cisco Firepower 4140	All versions
Cisco Firepower 4145	All versions
Cisco Firepower 4150	All versions
Cisco Firepower 9300	All versions

Configuration P

154 vulnerable

Vulnerable Software	Affected Versions
Cisco Automated Subsea Tuning	Version 02.01.00
Cisco Broadworks	All versions
Cisco Cloudcenter Suite	Version 4.10.0.15
Cisco Cloudcenter Suite	Version 5.3.0
Cisco Cloudcenter Suite	Version 5.4.1
Cisco Cloudcenter Suite	Version 5.5.0
Cisco Cloudcenter Suite	Version 5.5.1
Cisco Common Services Platform Collector	Version 002.009(000.000)
Cisco Common Services Platform Collector	Version 002.009(000.001)
Cisco Common Services Platform Collector	Version 002.009(000.002)
Cisco Common Services Platform Collector	Version 002.009(001.000)
Cisco Common Services Platform Collector	Version 002.009(001.001)
Cisco Common Services Platform Collector	Version 002.009(001.002)
Cisco Common Services Platform Collector	Version 002.010(000.000)
Cisco Crosswork Network Automation	All versions
Cisco Crosswork Network Automation	Version 2.0.0
Cisco Crosswork Network Automation	Version 3.0.0
Cisco Crosswork Network Automation	Version 4.1.0
Cisco Crosswork Network Automation	Version 4.1.1
Cisco Cx Cloud Agent	Version 001.012
Cisco Cyber Vision	Version 4.0.2
Cisco Cyber Vision Sensor Management Extension	Version 4.0.2
Cisco Dna Center	Version 2.2.2.8
Cisco Dna Spaces	All versions
Cisco Dna Spaces Connector	All versions
Cisco Emergency Responder	Version 11.5
Cisco Emergency Responder	Version 11.5(4.65000.14)
Cisco Emergency Responder	Version 11.5(4.66000.14)
Cisco Enterprise Chat And Email	Version 12.0(1)
Cisco Enterprise Chat And Email	Version 12.5(1)
Cisco Enterprise Chat And Email	Version 12.6(1)
Cisco Evolved Programmable Network Manager	Version 3.0
Cisco Evolved Programmable Network Manager	Version 3.1
Cisco Evolved Programmable Network Manager	Version 4.0
Cisco Evolved Programmable Network Manager	Version 4.1
Cisco Evolved Programmable Network Manager	Version 5.0
Cisco Evolved Programmable Network Manager	Version 5.1
Cisco Finesse	Version 12.5(1) su1
Cisco Finesse	Version 12.5(1) su2
Cisco Finesse	Version 12.6(1)
Cisco Finesse	Version 12.6(1) es01
Cisco Finesse	Version 12.6(1) es02
Cisco Finesse	Version 12.6(1) es03
Cisco Firepower Threat Defense	Version 6.2.3
Cisco Firepower Threat Defense	Version 6.3.0
Cisco Firepower Threat Defense	Version 6.4.0
Cisco Firepower Threat Defense	Version 6.5.0
Cisco Firepower Threat Defense	Version 6.6.0
Cisco Firepower Threat Defense	Version 6.7.0
Cisco Firepower Threat Defense	Version 7.0.0
Cisco Firepower Threat Defense	Version 7.1.0
Cisco Identity Services Engine	Version 002.004(000.914)
Cisco Identity Services Engine	Version 002.006(000.156)
Cisco Identity Services Engine	Version 002.007(000.356)
Cisco Identity Services Engine	Version 003.000(000.458)
Cisco Identity Services Engine	Version 003.001(000.518)
Cisco Identity Services Engine	Version 003.002(000.116)
Cisco Integrated Management Controller Supervisor	Version 002.003(002.000)
Cisco Integrated Management Controller Supervisor	Version 2.3.2.0
Cisco Intersight Virtual Appliance	Version 1.0.9-343
Cisco Mobility Services Engine	All versions
Cisco Network Assurance Engine	Version 6.0(2.1912)
Cisco Network Dashboard Fabric Controller	Version 11.0(1)
Cisco Network Dashboard Fabric Controller	Version 11.1(1)
Cisco Network Dashboard Fabric Controller	Version 11.2(1)
Cisco Network Dashboard Fabric Controller	Version 11.3(1)
Cisco Network Dashboard Fabric Controller	Version 11.4(1)
Cisco Network Dashboard Fabric Controller	Version 11.5(1)
Cisco Network Dashboard Fabric Controller	Version 11.5(2)
Cisco Network Dashboard Fabric Controller	Version 11.5(3)
Cisco Network Insights For Data Center	Version 6.0(2.1914)
Cisco Network Services Orchestrator	All versions
Cisco Optical Network Controller	Version 1.1
Cisco Paging Server	Version 12.5(2)
Cisco Paging Server	Version 14.0(1)
Cisco Paging Server	Version 8.3(1)
Cisco Paging Server	Version 8.4(1)
Cisco Paging Server	Version 8.5(1)
Cisco Paging Server	Version 9.0(1)
Cisco Paging Server	Version 9.0(2)
Cisco Paging Server	Version 9.1(1)
Cisco Prime Service Catalog	Version 12.1
Cisco Sd Wan Vmanage	Version 20.3
Cisco Sd Wan Vmanage	Version 20.4
Cisco Sd Wan Vmanage	Version 20.5
Cisco Sd Wan Vmanage	Version 20.6.1
Cisco Sd Wan Vmanage	Version 20.6
Cisco Sd Wan Vmanage	Version 20.7
Cisco Sd Wan Vmanage	Version 20.8
Cisco Smart Phy	Version 21.3
Cisco Smart Phy	Version 3.1.2
Cisco Smart Phy	Version 3.1.3
Cisco Smart Phy	Version 3.1.4
Cisco Smart Phy	Version 3.1.5
Cisco Smart Phy	Version 3.2.1
Cisco Ucs Central Software	Version 2.0
Cisco Ucs Central Software	Version 2.0(1a)
Cisco Ucs Central Software	Version 2.0(1b)
Cisco Ucs Central Software	Version 2.0(1c)
Cisco Ucs Central Software	Version 2.0(1d)
Cisco Ucs Central Software	Version 2.0(1e)
Cisco Ucs Central Software	Version 2.0(1f)
Cisco Ucs Central Software	Version 2.0(1g)
Cisco Ucs Central Software	Version 2.0(1h)
Cisco Ucs Central Software	Version 2.0(1k)
Cisco Ucs Central Software	Version 2.0(1l)
Cisco Unified Communications Manager	Version 11.5(1.17900.52)
Cisco Unified Communications Manager	Version 11.5(1.18119.2)
Cisco Unified Communications Manager	Version 11.5(1.18900.97)
Cisco Unified Communications Manager	Version 11.5(1.21900.40)
Cisco Unified Communications Manager	Version 11.5(1.22900.28)
Cisco Unified Communications Manager Im & Presence Service	Version 11.5(1.22900.6)
Cisco Unified Communications Manager Im & Presence Service	Version 11.5(1)
Cisco Unified Computing System	Version 006.008(001.000)
Cisco Unified Contact Center Enterprise	Version 11.6(2)
Cisco Unified Contact Center Enterprise	Version 12.0(1)
Cisco Unified Contact Center Enterprise	Version 12.5(1)
Cisco Unified Contact Center Enterprise	Version 12.6(1)
Cisco Unified Contact Center Enterprise	Version 12.6(2)
Cisco Unified Contact Center Express	Version 12.5(1)
Cisco Unified Contact Center Express	Version 12.5(1) su1
Cisco Unified Contact Center Express	Version 12.6(1)
Cisco Unified Contact Center Express	Version 12.6(2)
Cisco Unified Contact Center Management Portal	Version 12.6(1)
Cisco Unified Customer Voice Portal	Version 11.6(1)
Cisco Unified Customer Voice Portal	Version 12.0(1)
Cisco Unified Customer Voice Portal	Version 12.5(1)
Cisco Unified Customer Voice Portal	Version 12.6(1)
Cisco Unified Intelligence Center	Version 12.6(1)
Cisco Unified Intelligence Center	Version 12.6(1) es01
Cisco Unified Intelligence Center	Version 12.6(1) es02
Cisco Unified Intelligence Center	Version 12.6(2)
Cisco Unified Sip Proxy	Version 010.000(000)
Cisco Unified Sip Proxy	Version 010.000(001)
Cisco Unified Sip Proxy	Version 010.002(000)
Cisco Unified Sip Proxy	Version 010.002(001)
Cisco Unified Workforce Optimization	Version 11.5(1) sr7
Cisco Unity Connection	Version 11.5
Cisco Unity Connection	Version 11.5(1.10000.6)
Cisco Video Surveillance Manager	Version 7.14(1.26)
Cisco Video Surveillance Manager	Version 7.14(2.26)
Cisco Video Surveillance Manager	Version 7.14(3.025)
Cisco Video Surveillance Manager	Version 7.14(4.018)
Cisco Virtual Topology System	Version 2.6.6
Cisco Wan Automation Engine	Version 7.1.3
Cisco Wan Automation Engine	Version 7.2.1
Cisco Wan Automation Engine	Version 7.2.2
Cisco Wan Automation Engine	Version 7.2.3
Cisco Wan Automation Engine	Version 7.3
Cisco Wan Automation Engine	Version 7.4
Cisco Wan Automation Engine	Version 7.5
Cisco Wan Automation Engine	Version 7.6
Cisco Webex Meetings Server	Version 3.0
Cisco Webex Meetings Server	Version 4.0

Configuration Q

2 vulnerable

Vulnerable Software	Affected Versions
Snowsoftware Snow Commander	Before 8.10.0
Snowsoftware Vm Access Proxy	Before 3.6

Configuration R

2 vulnerable

Vulnerable Software	Affected Versions
Bentley Synchro	From 6.1 to 6.2.4.2
Bentley Synchro 4d	Before 6.4.3.2

Configuration S

1 vulnerable

Vulnerable Software	Affected Versions
Percussion Rhythmyx	Up to 7.3.2

Configuration T

1 vulnerable

Vulnerable Software	Affected Versions
Apple Xcode	Before 13.3

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

References (103)

http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html

Source: security@apache.org

Broken LinkThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2022/Dec/2

Source: security@apache.org

ExploitMailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/Jul/11

Source: security@apache.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/Mar/23

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/12/10/1

Source: security@apache.org

Mailing ListMitigationThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/12/10/2

Source: security@apache.org

Mailing ListMitigationThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/12/10/3

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/12/13/1

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/12/13/2

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/12/14/4

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/12/15/3

Source: security@apache.org

Mailing ListThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf

Source: security@apache.org

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf

Source: security@apache.org

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf

Source: security@apache.org

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf

Source: security@apache.org

Third Party Advisory

https://github.com/cisagov/log4j-affected-db

Source: security@apache.org

Third Party Advisory

https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md

Source: security@apache.org

Broken LinkProductUS Government Resource

https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228

Source: security@apache.org

ExploitThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/

Source: security@apache.org

Release Notes

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/

Source: security@apache.org

Release Notes

https://logging.apache.org/log4j/2.x/security.html

Source: security@apache.org

Release NotesVendor Advisory

https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/

Source: security@apache.org

PatchThird Party AdvisoryVendor Advisory

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032

Source: security@apache.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20211210-0007/

Source: security@apache.org

Third Party Advisory

https://support.apple.com/kb/HT213189

Source: security@apache.org

Third Party Advisory

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

Source: security@apache.org

Third Party Advisory

https://twitter.com/kurtseifried/status/1469345530182455296

Source: security@apache.org

Broken LinkExploitThird Party Advisory

https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2021/dsa-5020

Source: security@apache.org

Mailing ListThird Party Advisory

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html

Source: security@apache.org

Third Party Advisory

https://www.kb.cert.org/vuls/id/930724

Source: security@apache.org

Third Party AdvisoryUS Government Resource

https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html

Source: security@apache.org

ExploitThird Party Advisory

https://www.oracle.com/security-alerts/alert-cve-2021-44228.html

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: security@apache.org

PatchThird Party Advisory

http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html