Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability (CVE-2016-6415)
Severity: high · Patch status: patched · Since 2023-05-19 · CVE-2016-6415
Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure. CISA added CVE-2016-6415 to its Known Exploited Vulnerabilities catalog on May 19, 2023, which means attackers are exploiting it in the wild.
What to do
- Apply updates per vendor instructions.
- US federal agencies must remediate by Jun 9, 2023 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
