CVE-2015-6429 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Cisco IOS

CWE-19CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
0.5%
top 35.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOSCisco IOS XE
Timeline
PublishedDec 19
Latest updateMay 17

Description

The IKEv1 state machine in Cisco IOS 15.4 through 15.6 and IOS XE 3.15 through 3.17 allows remote attackers to cause a denial of service (IPsec connection termination) via a crafted IKEv1 packet to a tunnel endpoint, aka Bug ID CSCuw08236.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDcisco/ios11 versions+10
▶NVDcisco/ios_xe7 versions+6

🔴Vulnerability Details

2
GHSA
GHSA-rv2q-3w65-6h82: The IKEv1 state machine in Cisco IOS 15↗2022-05-17
▶
CVEList
CVE-2015-6429: The IKEv1 state machine in Cisco IOS 15↗2015-12-19
▶

📋Vendor Advisories

1
Cisco
Cisco IOS and IOS XE Software IKEv1 State Machine Denial of Service Vulnerability↗2015-12-18
▶
CVE-2015-6429 — Cisco IOS vulnerability | cvebase