Security readout for executives and security teams
Plain-English summary
This flaw lets someone already connected to the same local network bypass some switch-level protections such as IPv6 RA Guard or ARP inspection. It is not an internet-ranged takeover issue, but it can weaken controls used to prevent local network impersonation or traffic manipulation.
Executive priority
Treat this as a targeted LAN integrity risk. Prioritize environments with shared access networks, guest networks, campus switching, or high reliance on Layer 2 filtering. It is below critical remote-code-execution urgency, but should be remediated during network maintenance cycles.
Technical view
CVE-2021-27853 covers bypass of Layer 2 filtering using stacked VLAN 0 and LLC/SNAP header combinations. The CVSS vector is adjacent network, low complexity, no privileges, no user interaction, changed scope, and low integrity impact. The affected source material references IEEE 802.2, P802.1Q, and the IETF RA Guard draft.
Likely exposure
Exposure is most likely in switched LAN environments relying on Layer 2 controls such as IPv6 RA Guard or ARP inspection. Cisco published an advisory for affected Cisco products, but the bundle does not enumerate every product or fixed release here. Attack access is adjacent-network, not remote internet.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Public research and CERT material describe the bypass class. Practical risk depends on whether an attacker can join the same Layer 2 segment and whether the network depends on these filters for integrity controls.
Researcher notes
Evidence supports a standards and implementation bypass class, not a universal product list in this bundle. Focus analysis on parser behavior for VLAN 0 plus LLC/SNAP handling and whether device filters normalize encapsulation before enforcing RA Guard or ARP inspection policy.
Mitigation direction
- Review the Cisco advisory and vendor guidance for affected platforms and fixed releases.
- Update affected network devices when vendor-fixed software is available.
- Do not rely solely on RA Guard or ARP inspection for critical trust boundaries.
- Add compensating monitoring for unexpected local network control-plane behavior.
- Validate segmentation and access controls for untrusted Layer 2 ports.
Validation and detection
- Inventory switches and security features using IPv6 RA Guard, ARP inspection, or similar L2 filtering.
- Map affected platforms against Cisco and CERT VU#855201 guidance.
- Confirm vendor software versions and documented remediation status.
- Use controlled defensive lab validation only, without production disruption.
- Review local network telemetry for suspicious control-plane or neighbor-discovery anomalies.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-290: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-27853 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.7MediumVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/CVE reference
- https://standards.ieee.org/ieee/802.2/1048/CVE reference
- https://standards.ieee.org/ieee/802.1Q/10323/CVE reference
- 20220927 Vulnerabilities in Layer 2 Network Security Controls Affecting Cisco Products: September 2022CVE reference · vendor-advisory
- https://kb.cert.org/vuls/id/855201CVE reference
- https://blog.champtar.fr/VLAN0_LLC_SNAP/CVE reference
- https://www.kb.cert.org/vuls/id/855201CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass by Spoofing
Authentication Bypass by Spoofing represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.