Security readout for executives and security teams
Plain-English summary
Traffic from the same local network can be shaped so Layer 2 filters, including IPv6 Router Advertisement Guard, may fail to recognize it. The business risk is integrity impact: a LAN-adjacent attacker could influence network control behavior. This is not described as an internet-remote vulnerability.
Executive priority
Prioritize review for shared LANs, guest networks, campus access layers, and virtualized networks where untrusted devices coexist. The score is medium, but the issue can undermine network policy assumptions in exposed local segments.
Technical view
CVE-2021-27861 is a Layer 2 filtering bypass using LLC/SNAP headers with invalid length fields, optionally combined with VLAN 0 headers. The CVSS vector is AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N. The sources identify affected standards and drafts, not named vendor device models.
Likely exposure
Exposure is most likely on networks relying on RA Guard or similar Layer 2 filtering, especially where untrusted users share a broadcast domain. Actual exposure depends on switch, router, virtual switch, or security-device implementation details not fully listed in the source bundle.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. The required position is adjacent network access, with no privileges or user interaction. Public research exists, so defenders should treat it as a practical LAN-segment bypass risk.
Researcher notes
Evidence centers on standards-level behavior and CERT/public research, not a comprehensive vendor matrix. Track implementation-specific advisories before declaring systems affected or remediated. Do not infer product exposure solely from support for VLANs, LLC/SNAP, or RA Guard.
Mitigation direction
- Check vendor advisories for affected network devices and filtering implementations.
- Apply relevant firmware, software, or configuration updates from vendors.
- Avoid relying on RA Guard as the only protection on untrusted LANs.
- Restrict untrusted hosts to segmented networks where feasible.
- Monitor for unexpected IPv6 router advertisements or routing changes.
Validation and detection
- Inventory segments that depend on RA Guard or Layer 2 filtering.
- Map switches, routers, virtual switches, and security appliances on those segments.
- Confirm vendor status for LLC/SNAP and VLAN 0 filtering behavior.
- Review logs for unexpected IPv6 RA or neighbor-discovery activity.
- Perform controlled validation only with approved defensive test procedures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-130: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-290: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-27861 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.7MediumVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/CVE reference
- https://standards.ieee.org/ieee/802.2/1048/CVE reference
- https://standards.ieee.org/ieee/802.1Q/10323/CVE reference
- https://kb.cert.org/vuls/id/855201CVE reference
- https://blog.champtar.fr/VLAN0_LLC_SNAP/CVE reference
- https://www.kb.cert.org/vuls/id/855201CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Handling of Length Parameter Inconsistency
Improper Handling of Length Parameter Inconsistency represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Authentication Bypass by Spoofing
Authentication Bypass by Spoofing represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.