CVE-2004-1111
Cisco IOS 2.2(18)EW, 12.2(18)EWA, 12.2(14)SZ, 12.2(18)S, 12.2(18)SE, 12.2(18)SV, 12.2(18)SW, and other versions without the "no service dhcp" command, keep undeliverable DHCP packets in the queue instead of dropping them, which allows remote attackers…
Does this matter?
Lower severity and a low EPSS score (2.34%). Track it; it rarely justifies an emergency change on its own.
Description
Cisco IOS 2.2(18)EW, 12.2(18)EWA, 12.2(14)SZ, 12.2(18)S, 12.2(18)SE, 12.2(18)SV, 12.2(18)SW, and other versions without the "no service dhcp" command, keep undeliverable DHCP packets in the queue instead of dropping them, which allows remote attackers to cause a denial of service (dropped traffic) via multiple undeliverable DHCP packets that exceed the input queue size.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 2.34% probability · 83th percentile
- CISA KEV
- Not listed
- Affected
- cisco/ios · cisco/multiservice platform 2650 · cisco/multiservice platform 2650xm · cisco/multiservice platform 2651 · cisco/multiservice platform 2651xm · cisco/7200 router · cisco/7300 router · cisco/7500 router · cisco/7600 router · cisco/catalyst 7600
- Source
- cve@mitre.org
References
- http://www.ciac.org/ciac/bulletins/p-034.shtml
- http://www.cisco.com/warp/public/707/cisco-sa-20041110-dhcp.shtml
- http://www.kb.cert.org/vuls/id/630104Third Party Advisory, US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA04-316A.htmlUS Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18021
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5632
- http://www.ciac.org/ciac/bulletins/p-034.shtml
- http://www.cisco.com/warp/public/707/cisco-sa-20041110-dhcp.shtml
- http://www.kb.cert.org/vuls/id/630104Third Party Advisory, US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA04-316A.htmlUS Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18021
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5632
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.