CVE-2015-6272
HighSummary
Cisco IOS XE versions 2.1.0 through 2.2.3 and 2.3.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allow remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted H.323 packet.
Risk Assessment
Attackers can remotely trigger a system crash, leading to denial of service and potential disruption of network operations.
Recommendation
It is recommended to upgrade to the latest version of Cisco IOS XE to mitigate this vulnerability.
Other vulnerabilities in Cisco IOS XE on ASR 1000 devices
See all- CVE-2015-6271High
Cisco IOS XE versions 2.1.0 through 2.4.3 and 2.5.0 on ASR 1000 devices, when using NAT Application Layer Gateway, allow remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted SIP packet.
- CVE-2015-6270High
Cisco IOS XE before version 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv6 packet.
- CVE-2015-6268High
Cisco IOS XE before version 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv4 UDP packet.
- CVE-2015-0685High
Cisco IOS XE before version 3.7.5S on ASR 1000 devices does not properly handle route adjacencies, allowing remote attackers to cause a denial of service (device hang) via crafted IP packets.
Original NVD description (English source)
Cisco IOS XE 2.1.0 through 2.2.3 and 2.3.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted H.323 packet, aka Bug ID CSCsx35393, CSCsx07094, and CSCsw93064.