CVE-2016-6386

HIGH

Cisco IOS XE 3.1-3.17 and 16.1 - Denial of Service via Fragmented IPv4 Packets

Title source: llm

Description

Cisco IOS XE 3.1 through 3.17 and 16.1 on 64-bit platforms allows remote attackers to cause a denial of service (data-structure corruption and device reload) via fragmented IPv4 packets, aka Bug ID CSCux66005.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1036914

Vendor Advisory vendor-advisory x_refsource_cisco

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-frag

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/93202

Scores

CVSS v3 7.5

EPSS 0.0287

EPSS Percentile 85.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-399

Status published

Products (50)

cisco/ios_xe 3.1.0s

cisco/ios_xe 3.1.0sg

cisco/ios_xe 3.1.1s

cisco/ios_xe 3.1.1sg

cisco/ios_xe 3.1.2s

cisco/ios_xe 3.1.3as

cisco/ios_xe 3.1.4as

cisco/ios_xe 3.1.4s

cisco/ios_xe 3.2.0se

cisco/ios_xe 3.2.1s

... and 40 more

Published Oct 05, 2016

Tracked Since Feb 18, 2026