PT-2001-1642 · Cisco · Cisco Vpn 3000 Series Concentrators

Published 2001-06-18 · Updated 2017-10-10 · CVE-2001-0427

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco VPN 3000 series concentrators versions prior to 2.5.2(F)

Description The issue allows remote attackers to cause a denial of service via a flood of invalid login requests to the SSL service or the telnet service. These services do not properly disconnect the user after several failed login attempts.

Recommendations For versions prior to 2.5.2(F), update to version 2.5.2(F) or later to resolve the issue. As a temporary workaround, consider restricting access to the SSL and telnet services to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2001-0427

Affected Products

Cisco Vpn 3000 Series Concentrators

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2001-0427 · Security Note
• http://cisco.com/warp/public/707/vpn3k-telnet-vuln-pub.shtml · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6298 · Note
• http://osvdb.org/5643 · Note