CVE-2010-2836 — Missing Release of Memory after Effective Lifetime in Cisco IOS

CWE-3994 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.4%
top 37.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco IOS
Timeline
PublishedSep 23
Latest updateMay 17

Description

Memory leak in the SSL VPN feature in Cisco IOS 12.4, 15.0, and 15.1, when HTTP port redirection is enabled, allows remote attackers to cause a denial of service (memory consumption) by improperly disconnecting SSL sessions, leading to connections that remain in the CLOSE-WAIT state, aka Bug ID CSCtg21685.

CVSS vector

AV:N/AC:L/C:N/I:N/A:CExploitability: 10.0 | Impact: 6.9

Affected Packages1 packages

▶NVDcisco/ios31 versions+30

Patches

Patch: www.cisco.com ↗Patch: www.cisco.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-7m26-wxj8-3cqr: Memory leak in the SSL VPN feature in Cisco IOS 12↗2022-05-17
▶
CVEList
CVE-2010-2836: Memory leak in the SSL VPN feature in Cisco IOS 12↗2010-09-23
▶

📋Vendor Advisories

1
Cisco
Cisco IOS SSL VPN Vulnerability↗2010-09-22
▶
CVE-2010-2836 — Cisco IOS vulnerability | cvebase