CVE-2012-0338: Cisco IOS 12.2 through 12.4 and 15.0 does not recognize the vrf-also keyword during enforcement of access-c...

Security readout for executives and security teams

This Cisco IOS issue can undermine management-access restrictions. Devices may ignore the vrf-also keyword when enforcing access-class rules, allowing SSH connections from source IP addresses that administrators expected to block. The sources do not state that SSH authentication is bypassed. Exposure is most likely on Cisco IOS devices in the named trains that permit SSH management and rely on access-class with vrf-also for source filtering. Treat this as a management-plane exposure issue. It is not listed as actively exploited, but affected network devices could accept SSH attempts from locations leadership believes are blocked. Mitigation focus: Inventory IOS 12.2, 12.3, 12.4, and 15.0 devices using SSH management.; Review Cisco guidance for bug CSCsv86113 and any fixed IOS releases.; Do not rely only on access-class vrf-also for SSH source control..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.