Cisco · IOS, IOS XR, and IOS XE
CVE-2016-6415
Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability
Cos'è
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.
CISA: Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure.
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 9 giugno 2023
Altre falle sfruttate di Cisco
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 14 ott 2026 | Relative Path Traversal | Secure Email Gateway | Critica 9,8 | 2,2% |
| 30 set 2026 | Hex Encoding | Catalyst SD-WAN Manager | Critica 9,8 | 39% |
| 16 set 2026 | Incorrect Use of Privileged APIs | Identity Services Engine | Critica 10,0 | 76% |
| 14 set 2026 | SQL Injection | Secure Email Gateway | Critica 9,8 | 30% |
| 9 set 2026 | Firewall Management Center Authentication Bypass Using an Alternate Path or Channel | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Critica 10,0 | 88% |
| 11 ago 2026 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | Alta 8,6 | 1,0% |
| 29 lug 2026 | Secure Firewall Management Center Use of Hard-coded Password | Secure Firewall Management Center (FMC) | Media 5,3 | 35% |
| 13 lug 2026 | Cross-Site Request Forgery | IOS | Alta 8,1 | 34% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.