CVE-2013-5498: The PPTP-ALG component in CRS Carrier Grade Services Engine (CGSE) and ASR 9000 Integrated Service Module (...

Security readout for executives and security teams

This issue can let a remote attacker crash and reset a Cisco service module by sending crafted traffic to the PPTP-ALG component. The business impact is availability: carrier or edge services using the affected Cisco IOS XR modules could experience disruption. The source bundle does not provide CVSS, fixed versions, or confirmed exploitation. Exposure is likely limited to organizations running Cisco IOS XR with CRS CGSE or ASR 9000 ISM and using or exposing the PPTP-ALG traffic path. The bundle does not support treating all Cisco IOS XR, CRS, or ASR 9000 deployments as affected. Prioritize validation for carrier, service-provider, or edge environments where module resets could interrupt customer-facing services. Urgency is lower where the named modules are absent or PPTP-ALG is not in the traffic path. Mitigation focus: Review Cisco's security notice for affected releases, fixed software, and workarounds.; Inventory CRS CGSE and ASR 9000 ISM deployments running Cisco IOS XR.; Prioritize remediation where PPTP-ALG processes untrusted or internet-adjacent traffic..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.