VulnerabilityModified
CVE-2016-6398
The PPTP server in Cisco IOS 15.5(3)M does not properly initialize packet buffers, which allows remote attackers to obtain sensitive information from earlier network communication by reading packet data, aka Bug ID CSCvb16274.
MEDIUM 5.3EPSS 1.26%
Does this matter?
Lower severity and a low EPSS score (1.26%). Track it; it rarely justifies an emergency change on its own.
Description
The PPTP server in Cisco IOS 15.5(3)M does not properly initialize packet buffers, which allows remote attackers to obtain sensitive information from earlier network communication by reading packet data, aka Bug ID CSCvb16274.
- CVSS 3.0
- 5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.26% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- cisco/ios
- Source
- psirt@cisco.com
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160902-iosVendor Advisory
- http://www.securityfocus.com/bid/92734
- http://www.securitytracker.com/id/1036732
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160902-iosVendor Advisory
- http://www.securityfocus.com/bid/92734
- http://www.securitytracker.com/id/1036732
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.