CVE-2012-5032
Cisco IOS < 15.1(1)SY3 - Unauthenticated VPN Traffic Manipulation via Flex-VPN Load-Balancing
Title source: llmDescription
The Flex-VPN load-balancing feature in the ipsec-ikev2 implementation in Cisco IOS before 15.1(1)SY3 does not require authentication, which allows remote attackers to trigger the forwarding of VPN traffic to an attacker-controlled destination, or the discarding of this traffic, by arranging for an arbitrary device to become a cluster member, aka Bug ID CSCub93641.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf
Scores
EPSS
0.0128
EPSS Percentile
66.4%
Details
CWE
CWE-287
Status
published
Products (4)
cisco/ios
15.1
cisco/ios
15.1\(1\)sy
cisco/ios
15.1\(1\)sy1
cisco/ios
< 15.1\(1\)sy2
Published
Apr 23, 2014
Tracked Since
Feb 18, 2026