CVE-2013-2779
Cisco IOS XE 3.4 before 3.4.5S, and 3.5 through 3.7 before 3.7.1S, on 1000 series Aggregation Services Routers (ASR) does not properly implement the Cisco Multicast Leaf Recycle Elimination (MLRE) feature, which allows remote attackers to cause a denial…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.96%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Cisco IOS XE 3.4 before 3.4.5S, and 3.5 through 3.7 before 3.7.1S, on 1000 series Aggregation Services Routers (ASR) does not properly implement the Cisco Multicast Leaf Recycle Elimination (MLRE) feature, which allows remote attackers to cause a denial of service (card reload) via fragmented IPv6 MVPN (aka MVPNv6) packets, aka Bug ID CSCub34945, a different vulnerability than CVE-2013-1164.
- CVSS 2.0
- 7.8 HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
- EPSS
- 1.96% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- cisco/ios xe · cisco/asr 1001 · cisco/asr 1002 · cisco/asr 1002-x · cisco/asr 1002 fixed router · cisco/asr 1004 · cisco/asr 1006 · cisco/asr 1013 · cisco/asr 1023 router
- Source
- cve@mitre.org
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.