CVE-2006-4650 — Cisco IOS vulnerability

3 documents3 sources
Severity
2.6LOWNVD
EPSS
0.6%
top 29.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco IOS
Timeline
PublishedSep 9
Latest updateMay 1

Description

Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet during decapsulation, which leads to an integer overflow that references data from incorrect memory locations, which allows remote attackers to inject crafted packets into the routing queue, possibly bypassing intended router ACLs.

CVSS vector

AV:N/AC:H/C:P/I:N/A:NExploitability: 4.9 | Impact: 2.9

Affected Packages1 packages

▶NVDcisco/ios12.0, 12.1, 12.2+2

🔴Vulnerability Details

2
GHSA
GHSA-522v-5cvx-8x8h: Cisco IOS 12↗2022-05-01
▶
CVEList
CVE-2006-4650: Cisco IOS 12↗2006-09-09
▶
CVE-2006-4650 — Cisco IOS vulnerability | cvebase