CVE-2015-6272: Cisco IOS XE 2.1.0 through 2.2.3 and 2.3.0 on ASR 1000 devices, when NAT Application Layer Gateway is used,...

Security readout for executives and security teams

This vulnerability can crash part of a Cisco ASR 1000 router when it processes a specially crafted H.323 packet while NAT Application Layer Gateway is in use. The business impact is network disruption, not data theft. Exposure appears limited to old Cisco IOS XE releases named in the CVE. Organizations are likely exposed only if they still operate Cisco ASR 1000 routers on the listed IOS XE versions with NAT ALG handling H.323 traffic. Modern patched deployments or environments not using that ALG path are less likely exposed, based on the supplied evidence. Treat this as an availability risk for legacy edge or aggregation routers. It is not KEV-listed in the provided data, but affected internet-facing or voice-related routing paths should be reviewed promptly because a crash can disrupt business connectivity. Mitigation focus: Inventory Cisco ASR 1000 devices and their IOS XE versions.; Check Cisco advisory 40689 for fixed software and supported workarounds.; Review whether H.323 NAT ALG is required on affected routers..

Prepared

Jun 13, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.