CVE-2007-4286
published 2007-08-09CVE-2007-4286: Buffer overflow in the Next Hop Resolution Protocol (NHRP) functionality in Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service…
PriorityP261critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
19.41%
97.1th percentile
Buffer overflow in the Next Hop Resolution Protocol (NHRP) functionality in Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service (restart) and execute arbitrary code via a crafted NHRP packet.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios_next_hop_resolution_protocol | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- ·NHRP is not enabled by default; only devices with NHRP explicitly configured (e.g., DMVPN tunnels) are vulnerable. Disabling NHRP is the stated workaround. ↗
- ·All three NHRP transport modes are affected: Layer 2, GRE/mGRE tunnels, and direct IP (proto 54) — detection must cover all three paths. ↗
- ·Two separate Cisco bug IDs track this issue: CSCin95836 for non-12.2 mainline releases and CSCsi23231 for 12.2 mainline releases — ensure the correct patch is applied per IOS train. ↗
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_cisco8.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco IOS Next Hop Resolution Protocol Vulnerability
vendor_cisco·2007-08-08·CVSS 8.0
CVE-2007-4286 [HIGH] CWE-119 Cisco IOS Next Hop Resolution Protocol Vulnerability
Cisco IOS Next Hop Resolution Protocol Vulnerability
The Cisco Next Hop Resolution Protocol (NHRP) feature in Cisco IOS
contains a vulnerability that can result in a restart of the device or possible
remote code execution.
NHRP is a primary component of the Dynamic Multipoint Virtual Private
Network (DMVPN) feature.
NHRP can operate in three ways: at the link layer (Layer 2), over
Generic Routing Encapsulation (GRE) and multipoint GRE (mGRE) tunnels and
directly on IP (IP protocol number 54). This vulnerability affects all three
methods of operation.
NHRP is not enabled by default for Cisco IOS.
This vulnerability is addressed by Cisco bug IDs
CSCin95836
(
registered customers only)
for non-12.2 mainline releases and
CSCsi23231
(
registered customers only)
for 12.2 mainline releases.
Th
Cisco
Cisco IOS Next Hop Resolution Protocol Vulnerability
vendor_cisco
CVE-2007-4286 Cisco IOS Next Hop Resolution Protocol Vulnerability
CVE-2007-4286: Cisco IOS Next Hop Resolution Protocol Vulnerability
The Cisco Next Hop Resolution Protocol (NHRP) feature in Cisco IOS contains a vulnerability that can result in a restart of the device or possible remote code execution. NHRP is a primary component of the Dynamic Multipoint Virtual Private Network (DMVPN) feature. NHRP can operate in three ways: at the link layer (Layer 2), over Generic Routing Encapsulation (GRE) and multipoint GRE (mGRE) tunnels and directly on IP (IP protocol number 54). This vulnerability affects all three methods of operation. NHRP is not enabled by default for Cisco IOS. This vulnerability is addressed by Cisco bug IDs CSCin95836 ( registered customers only ) for non-12.2 mainline releases and CSCsi23231 ( registered customers only ) for 12.2 mainlin
GHSA
GHSA-4xx2-mrcw-w2xx: Buffer overflow in the Next Hop Resolution Protocol (NHRP) functionality in Cisco IOS 12
ghsa_unreviewed·2022-05-01
CVE-2007-4286 [HIGH] CWE-119 GHSA-4xx2-mrcw-w2xx: Buffer overflow in the Next Hop Resolution Protocol (NHRP) functionality in Cisco IOS 12
Buffer overflow in the Next Hop Resolution Protocol (NHRP) functionality in Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service (restart) and execute arbitrary code via a crafted NHRP packet.
No detection rules found.
No writeups or analysis indexed.
http://secunia.com/advisories/26360http://www.cisco.com/en/US/products/products_security_advisory09186a008089963b.shtmlhttp://www.kb.cert.org/vuls/id/201984http://www.securityfocus.com/archive/1/475931/100/0/threadedhttp://www.securityfocus.com/bid/25238http://www.securitytracker.com/id?1018535http://www.vupen.com/english/advisories/2007/2818https://exchange.xforce.ibmcloud.com/vulnerabilities/35889https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5675http://secunia.com/advisories/26360http://www.cisco.com/en/US/products/products_security_advisory09186a008089963b.shtmlhttp://www.kb.cert.org/vuls/id/201984http://www.securityfocus.com/archive/1/475931/100/0/threadedhttp://www.securityfocus.com/bid/25238http://www.securitytracker.com/id?1018535http://www.vupen.com/english/advisories/2007/2818https://exchange.xforce.ibmcloud.com/vulnerabilities/35889https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5675
2007-08-09
Published