CVE-2014-2146
MEDIUMCisco - SSRF
Title source: llmDescription
The Zone-Based Firewall (ZBFW) functionality in Cisco IOS, possibly 15.4 and earlier, and IOS XE, possibly 3.13 and earlier, mishandles zone checking for existing sessions, which allows remote attackers to bypass intended resource-access restrictions via spoofed traffic that matches one of these sessions, aka Bug IDs CSCun94946 and CSCun96847.
Scores
CVSS v3
6.5
EPSS
0.0023
EPSS Percentile
45.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Classification
CWE
CWE-20
Status
published
Affected Products (3)
cisco/ios
< 15.4\(1\)t1
cisco/ios_xe
< 15.4\(3\)s
n/a/n/a
Timeline
Published
Sep 22, 2016
Tracked Since
Feb 18, 2026