High · CVSS 7.5 · CISA KEV
A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper translation of H.323 messages that use the Registration, Admission, and Status (RAS) protocol and are sent to an affected device via IPv4 packets. An attacker could exploit this vulnerability by sending a crafted H.323 RAS packet through an affected device. A successful exploit could allow the attacker to cause the affected device to crash and reload, resulting in a DoS condition. This vulnerability affects Cisco devices that are configured to use an application layer gateway with NAT (NAT ALG) for H.323 RAS messages. By default, a NAT ALG is enabled for H.323 RAS messages. Cisco Bug IDs: CSCvc57217.
Published Sep 28, 2017 · Updated Jan 14, 2026
Critical · CVSS 9.8 · CISA KEV
The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a buffer overflow condition in the DHCP relay subsystem of the affected software. An attacker could exploit this vulnerability by sending a crafted DHCP Version 4 (DHCPv4) packet to an affected system. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a DoS condition. Cisco Bug IDs: CSCsm45390, CSCuw77959.
Published Sep 28, 2017 · Updated Jan 12, 2026
Medium · CVSS 6.5 · CISA KEV
A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a denial of service (DoS) condition. The vulnerability is due to a memory management issue in the affected software. An attacker could exploit this vulnerability by creating a large number of VPLS-generated MAC entries in the MAC address table of an affected device. A successful exploit could allow the attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a DoS condition. This vulnerability affects Cisco Catalyst 6800 Series Switches that are running a vulnerable release of Cisco IOS Software and have a Cisco C6800-16P10G or C6800-16P10G-XL line card in use with Supervisor Engine 6T. To be vulnerable, the device must also be configured with VPLS and the C6800-16P10G or C6800-16P10G-XL line card needs to be the core-facing MPLS interfaces. Cisco Bug IDs: CSCva61927.
Published Sep 28, 2017 · Updated Jan 12, 2026
High · CVSS 7.5 · CISA KEV
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to how an affected device processes certain IKEv2 packets. An attacker could exploit this vulnerability by sending specific IKEv2 packets to an affected device to be processed. A successful exploit could allow the attacker to cause high CPU utilization, traceback messages, or a reload of the affected device that leads to a DoS condition. This vulnerability affects Cisco devices that have the Internet Security Association and Key Management Protocol (ISAKMP) enabled. Although only IKEv2 packets can be used to trigger this vulnerability, devices that are running Cisco IOS Software or Cisco IOS XE Software are vulnerable when ISAKMP is enabled. A device does not need to be configured with any IKEv2-specific features to be vulnerable. Many features use IKEv2, including different types of VPNs such as the following: LAN-to-LAN VPN; Remote-access VPN, excluding SSL VPN; Dynamic Multipoint VPN (DMVPN); and FlexVPN. Cisco Bug IDs: CSCvc41277.
Published Sep 28, 2017 · Updated Jan 12, 2026
High · CVSS 7.5 · CISA KEV
A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper parsing of ingress PN-DCP Identify Request packets destined to an affected device. An attacker could exploit this vulnerability by sending a crafted PN-DCP Identify Request packet to an affected device and then continuing to send normal PN-DCP Identify Request packets to the device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. This vulnerability affects Cisco devices that are configured to process PROFINET messages. Beginning with Cisco IOS Software Release 12.2(52)SE, PROFINET is enabled by default on all the base switch module and expansion-unit Ethernet ports. Cisco Bug IDs: CSCuz47179.
Published Sep 28, 2017 · Updated Jan 12, 2026
High · CVSS 7.5 · CISA KEV
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of crafted CIP packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted CIP packets to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvc43709.
Published Sep 28, 2017 · Updated Jan 12, 2026
High · CVSS 7.5 · CISA KEV
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of crafted CIP packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted CIP packets to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuz95334.
Published Sep 28, 2017 · Updated Jan 12, 2026
Medium · CVSS 6.5 · CISA KEV
A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.0 through 15.6 could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a misclassification of Ethernet frames. An attacker could exploit this vulnerability by sending a crafted Ethernet frame to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvc03809.
Published Sep 28, 2017 · Updated Jan 12, 2026
Critical · CVSS 9.8
The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printts().
Published Sep 14, 2017 · Updated Dec 5, 2025
Critical · CVSS 9.8
The LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_mgmt_addr_tlv_print().
Published Sep 14, 2017 · Updated Dec 5, 2025
Critical · CVSS 9.8
The LLDP parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-lldp.c:lldp_private_8021_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The PIMv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-pim.c:pimv2_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The DNS parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-domain.c:ns_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:bgp_attr_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c, several functions.
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The RIPng parser in tcpdump before 4.9.2 has a buffer over-read in print-ripng.c:ripng_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The ISAKMP parser in tcpdump before 4.9.2 could enter an infinite loop due to bugs in print-isakmp.c, several functions.
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The IPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-ip6.c:ip6_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The Zephyr parser in tcpdump before 4.9.2 has a buffer over-read in print-zephyr.c, several functions.
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The EIGRP parser in tcpdump before 4.9.2 has a buffer over-read in print-eigrp.c:eigrp_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The DECnet parser in tcpdump before 4.9.2 has a buffer over-read in print-decnet.c:decnet_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:interp_reply().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The ISO CLNS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isoclns_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:isakmp_rfc3948_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
Several protocol parsers in tcpdump before 4.9.2 could cause a buffer over-read in addrtoname.c:lookup_bytestring().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The SMB/CIFS parser in tcpdump before 4.9.2 has a buffer over-read in smbutil.c:name_len().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The DHCPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-dhcp6.c:dhcp6opt_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The EAP parser in tcpdump before 4.9.2 has a buffer over-read in print-eap.c:eap_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The White Board protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-wb.c:wb_prep(), several functions.
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The ARP parser in tcpdump before 4.9.2 has a buffer over-read in print-arp.c, several functions.
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The BEEP parser in tcpdump before 4.9.2 has a buffer over-read in print-beep.c:l_strnstart().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The L2TP parser in tcpdump before 4.9.2 has a buffer over-read in print-l2tp.c, several functions.
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The AODV parser in tcpdump before 4.9.2 has a buffer over-read in print-aodv.c:aodv_extension().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:nfs_printfh().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The IEEE 802.15.4 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_15_4.c:ieee802_15_4_if_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The BOOTP parser in tcpdump before 4.9.2 has a buffer over-read in print-bootp.c:bootp_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printroute().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print_id().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The IPv6 fragmentation header parser in tcpdump before 4.9.2 has a buffer over-read in print-frag6.c:frag6_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp().
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The MPTCP parser in tcpdump before 4.9.2 has a buffer over-read in print-mptcp.c, several functions.
Published Sep 14, 2017 · Updated Dec 4, 2025
Critical · CVSS 9.8
The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print().
Published Sep 14, 2017 · Updated Dec 4, 2025
