SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2016-2774

ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by…

MEDIUM 5.9EPSS 73.6%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 73.6%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions.

CVSS 3.1
5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
73.62% probability · 99th percentile
CISA KEV
Not listed
Weakness
CWE-20
Affected
isc/dhcp · debian/debian linux · canonical/ubuntu linux
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.