PT-2014-4540 · Cisco · Cisco Ios Xe

Published 2014-04-28 · Updated 2021-10-05 · CVE-2014-2183

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 3.10S(.2) and earlier

Description A vulnerability in the Layer 2 Tunneling Protocol (L2TP) module allows remote authenticated users to cause a denial of service via a malformed L2TP packet. The vulnerability occurs during the processing of such a packet, and an attacker could exploit it by sending malformed packets over an established L2TP session, potentially causing a reload of the affected ESP card. To exploit this issue, an attacker must first authenticate to the targeted device.

Recommendations For Cisco IOS XE versions 3.10S(.2) and earlier, update to a newer version that includes the fix for this issue, as indicated by Cisco's security notice.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-2183

Affected Products

Cisco Ios Xe

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-2183 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=33971 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140428-CVE-2014-2183 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2183 · Vendor Advisory