CVEvulnerability

CVE-2014-2146

6.5 MEDIUM Published 2016-09-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-09-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-20

Description

The Zone-Based Firewall (ZBFW) functionality in Cisco IOS, possibly 15.4 and earlier, and IOS XE, possibly 3.13 and earlier, mishandles zone checking for existing sessions, which allows remote attackers to bypass intended resource-access restrictions via spoofed traffic that matches one of these sessions, aka Bug IDs CSCun94946 and CSCun96847.

Affected configurations

• cisco ios (<= 15.4\(1\)t1) • cisco ios xe (<= 15.4\(3\)s)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References