PT-2014-5292 · Cisco · Cisco Ios Xe

Published 2014-10-10 · Updated 2014-10-10 · CVE-2014-3403

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XE (affected versions not specified)

Description The issue is related to incomplete certificate validation in the Autonomic Networking Infrastructure (ANI) component, allowing remote attackers to masquerade as another device by sending crafted messages. This can be exploited by an unauthenticated, remote attacker. The vulnerability may require the attacker to have access to trusted, internal networks to send crafted messages to the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-3403

Affected Products

Cisco Ios Xe

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-3403 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3403 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20141010-CVE-2014-3403 · Vendor Advisory