CVE-2001-0864: Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly handle the implicit "deny ip a...

Security readout for executives and security teams

This flaw affects a narrow Cisco 12000 router configuration. Under a specific ACL size, packets that should be blocked by the default deny rule may be allowed out. Business impact depends on whether old Cisco 12000 IOS 12.0 routers with Engine 2 line cards remain in service. Exposure appears limited to legacy Cisco 12000 deployments using IOS 12.0, Engine 2-based line cards, and outgoing ACLs with exactly 448 entries. The supplied CVE data does not identify broader affected products or versions. Treat as targeted legacy-network risk, not a broad internet emergency. If affected routers still protect sensitive environments, prioritize confirmation and vendor-guided remediation because ACL bypass can undermine enforced traffic policy. Mitigation focus: Check Cisco advisory GSR-ACL-pub.shtml for fixed software and official workarounds.; Inventory Cisco 12000 routers running IOS 12.0 with Engine 2 line cards.; Prioritize review of outgoing ACLs containing exactly 448 entries..

Prepared

Jul 1, 2026, 07:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.