CVE-2016-6399
Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause a denial of service (device reload) via crafted (1) SSL or (2) TLS packets, aka Bug ID…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.94%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause a denial of service (device reload) via crafted (1) SSL or (2) TLS packets, aka Bug ID CSCvb16317.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.94% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- cisco/ace application control engine module a1 · cisco/ace application control engine module a3 · cisco/ace application control engine module a4 · cisco/ace application control engine module a5 · cisco/ace 4700 series application control engine appliance · cisco/ace 4700 series application control engine appliance a1 · cisco/ace 4700 series application control engine appliance a3 · cisco/ace 4700 series application control engine appliance a4 · cisco/ace 4700 series application control engine appliance a5
- Source
- psirt@cisco.com
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160908-aceVendor Advisory
- http://www.securityfocus.com/bid/92867
- http://www.securitytracker.com/id/1036748
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160908-aceVendor Advisory
- http://www.securityfocus.com/bid/92867
- http://www.securitytracker.com/id/1036748
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.