CVE-2007-4286

Cisco IOS 12.0-12.4 - Remote Code Execution and Denial of Service via NHRP Packet

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-4286. PoCs published by Martin Kluge.

AI-analyzed exploit summary This exploit targets a DoS vulnerability in Cisco IOS NHRP implementation (CVE-2007-4286) by sending malformed GRE packets. It causes a crash or hang on vulnerable routers, even with NHRP authentication enabled.

Description

Buffer overflow in the Next Hop Resolution Protocol (NHRP) functionality in Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service (restart) and execute arbitrary code via a crafted NHRP packet.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Martin Kluge · cdoswindows
https://www.exploit-db.com/exploits/4272

This exploit targets a DoS vulnerability in Cisco IOS NHRP implementation (CVE-2007-4286) by sending malformed GRE packets. It causes a crash or hang on vulnerable routers, even with NHRP authentication enabled.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: Cisco IOS (multiple versions, e.g., 12.2-12.3)
No auth needed
Prerequisites: NHRP session established between target and client · GRE key if tunnel is protected
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (9)

Core 9
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/25238
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26360
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/201984
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/35889
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5675
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/475931/100/0/threaded
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/2818
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1018535

Scores

EPSS 0.1941
EPSS Percentile 97.0%

Details

CWE
CWE-119
Status published
Products (5)
cisco/ios 12.0
cisco/ios 12.1
cisco/ios 12.2
cisco/ios 12.3
cisco/ios 12.4
Published Aug 09, 2007
Tracked Since Feb 18, 2026