CVE-2015-6271
HighSummary
Cisco IOS XE versions 2.1.0 through 2.4.3 and 2.5.0 on ASR 1000 devices, when using NAT Application Layer Gateway, allow remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted SIP packet.
Risk Assessment
Attackers can exploit this vulnerability to remotely trigger a system crash, leading to service availability interruptions.
Recommendation
It is recommended to update the software to the latest version to mitigate this vulnerability and to monitor SIP traffic for potential attacks.
Other vulnerabilities in Cisco IOS XE on ASR 1000 devices
See all- CVE-2015-6272High
Cisco IOS XE versions 2.1.0 through 2.2.3 and 2.3.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allow remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted H.323 packet.
- CVE-2015-6270High
Cisco IOS XE before version 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv6 packet.
- CVE-2015-6268High
Cisco IOS XE before version 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv4 UDP packet.
- CVE-2015-0685High
Cisco IOS XE before version 3.7.5S on ASR 1000 devices does not properly handle route adjacencies, allowing remote attackers to cause a denial of service (device hang) via crafted IP packets.
Original NVD description (English source)
Cisco IOS XE 2.1.0 through 2.4.3 and 2.5.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted SIP packet, aka Bug IDs CSCta74749 and CSCta77008.