CVE-2015-6269: Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedde...

Security readout for executives and security teams

This vulnerability can let a remote attacker crash the Embedded Services Processor on Cisco ASR 1000 routers by sending a crafted IPv4 or IPv6 packet. The practical business risk is network service interruption on exposed, outdated routers, not data theft. Exposure is limited to Cisco ASR 1000 routers running IOS XE versions before 2.2.3. Internet-facing or untrusted-network-facing routers would matter most. Current exposure depends on whether legacy ASR 1000 devices remain in service. Treat this as a legacy network availability risk. It is most urgent where ASR 1000 routers are exposed to untrusted traffic or support critical connectivity. Lack of active exploitation evidence lowers urgency, but outage impact can still be material. Mitigation focus: Inventory Cisco ASR 1000 routers and record IOS XE versions.; Prioritize devices running IOS XE before 2.2.3.; Review Cisco advisory guidance for fixed releases and supported upgrade paths..

Prepared

Jun 13, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.