CVE-2015-6365 — Improper Input Validation in Cisco IOS

CWE-20 — Improper Input Validation4 documents4 sources
Severity
4.0MEDIUMNVD
EPSS
0.2%
top 59.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco IOS
Timeline
PublishedNov 14
Latest updateMay 17

Description

Cisco IOS 15.2(04)M and 15.4(03)M lets physical-interface ACLs supersede virtual PPP interface ACLs, which allows remote authenticated users to bypass intended network-traffic restrictions in opportunistic circumstances by using PPP, aka Bug ID CSCur61303.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 8.0 | Impact: 2.9

Affected Packages1 packages

▶NVDcisco/ios15.2\(4\)m, 15.4\(3\)m+1

🔴Vulnerability Details

2
GHSA
GHSA-xrxc-57v3-82rr: Cisco IOS 15↗2022-05-17
▶
CVEList
CVE-2015-6365: Cisco IOS 15↗2015-11-14
▶

📋Vendor Advisories

1
Cisco
Cisco IOS Software Virtual PPP Interfaces Security Bypass Vulnerability↗2015-11-13
▶
CVE-2015-6365 — Improper Input Validation in Cisco IOS | cvebase