CVE-2016-6422 — Improper Input Validation in Cisco IOS

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 56.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco IOS
Timeline
PublishedOct 6
Latest updateMay 17

Description

Cisco IOS 12.2(33)SXJ9 on Supervisor Engine 32 and 720 modules for 6500 and 7600 devices mishandles certain operators, flags, and keywords in TCAM share ACLs, which allows remote attackers to bypass intended access restrictions by sending packets that should have been recognized by a filter, aka Bug ID CSCuy64806.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDcisco/ios12.2\(33\)sxj9

🔴Vulnerability Details

2
GHSA
GHSA-phhm-6h54-j6xc: Cisco IOS 12↗2022-05-17
▶
CVEList
CVE-2016-6422: Cisco IOS 12↗2016-10-06
▶

📋Vendor Advisories

1
Cisco
Cisco IOS Software for Cisco Catalyst 6500 Series Switches and 7600 Series Routers ACL Bypass Vulnerability↗2016-10-05
▶
CVE-2016-6422 — Improper Input Validation in Cisco IOS | cvebase