CVE-2003-0260: Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client 2.x.x through 3.6.7A allow remote at...

Security readout for executives and security teams

This CVE describes a remote denial-of-service weakness in legacy Cisco VPN 3000 concentrators and Cisco VPN 3002 Hardware Client software. A flood of malformed ICMP traffic could slow the device or cause a reload, disrupting VPN access. The bundle does not provide CVSS data or confirmed active exploitation. Exposure is most likely where affected Cisco VPN appliances or hardware clients remain reachable by untrusted networks and accept ICMP traffic. Because these are legacy products, risk depends heavily on whether any devices remain in production, labs, or forgotten perimeter segments. Treat this as a legacy perimeter availability risk. It is not described as a breach vector, but disruption to VPN access can affect operations. Priority should be higher if affected devices are internet-facing or support critical remote access. Mitigation focus: Inventory Cisco VPN 3000 and VPN 3002 deployments, including retired or lab networks.; Check Cisco advisory guidance for fixed software, upgrade paths, or vendor-recommended mitigations.; Limit ICMP exposure to affected VPN devices where operationally feasible..

Prepared

Jun 30, 2026, 11:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.