CVE-2016-6474 — Improper Authentication in Cisco IOS

CWE-287 — Improper Authentication4 documents4 sources
Severity
7.3HIGHNVD
EPSS
0.3%
top 45.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOSCisco IOS
Timeline
PublishedDec 14
Latest updateMay 17

Description

A vulnerability in the implementation of X.509 Version 3 for SSH authentication functionality in Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication on an affected system. More Information: CSCuv89417. Known Affected Releases: 15.5(2.25)T. Known Fixed Releases: 15.2(4)E1 15.2(4)E2 15.2(4)E3 15.2(4)EA4 15.2(4.0r)EB 15.2(4.1.27)EB 15.2(4.4.2)EA4 15.2(4.7.1)EC 15.2(4.7.2)EC 15.2(5.1.1)E 15.2(5.5.63)E 15.2(5.5.64)E 15.4(1)IA1.80 15.5(3)M1.1 15.5(3)M…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 3.9 | Impact: 3.4

Affected Packages2 packages

▶NVDcisco/ios15.5\(2.25\)t
▶CVEListV5cisco/cisco_iosCisco IOS

🔴Vulnerability Details

2
GHSA
GHSA-xqx5-4vvj-rqwr: A vulnerability in the implementation of X↗2022-05-17
▶
CVEList
CVE-2016-6474: A vulnerability in the implementation of X↗2016-12-14
▶

📋Vendor Advisories

1
Cisco
Cisco IOS and IOS XE Software SSH X.509 Authentication Bypass Vulnerability↗2016-12-07
▶
CVE-2016-6474 — Improper Authentication in Cisco IOS | cvebase