CVE-2013-6692: Medium severity Cisco IOS XE vulnerability
Published Nov 22, 2013
·Updated
Cisco IOS XE 3.8S(.2) and earlier does not properly use a DHCP pool during assignment of an IP address, which allows remote authenticated users to cause a denial of service (device reload) via an AAA packet that triggers an address requirement, aka Bug ID CSCuh04949.
Affected Software
7 affected components
Cisco IOS XE<=3.8s\(.2\)
Cisco IOS XE=3.7.0s
Cisco IOS XE=3.7.1s
Cisco IOS XE=3.7.2s
Cisco IOS XE=3.8.0s
Cisco IOS XE=3.8s\(.0\)
Cisco IOS XE=3.8s\(.1\)
Event History
Nov 22, 2013
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Data Sourced
via NVD·01:55 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-6692?
CVE-2013-6692 is classified as a denial of service vulnerability affecting Cisco IOS XE.
2
How do I fix CVE-2013-6692?
To fix CVE-2013-6692, upgrade to Cisco IOS XE version 3.8S(3) or later.
3
What causes the denial of service in CVE-2013-6692?
The denial of service in CVE-2013-6692 occurs due to improper DHCP pool usage during IP address assignment.
4
Who is affected by CVE-2013-6692?
CVE-2013-6692 affects remote authenticated users of Cisco IOS XE versions 3.8S(2) and earlier.
5
Is CVE-2013-6692 easy to exploit?
Yes, CVE-2013-6692 can be exploited by remote authenticated users with minimal effort to trigger a device reload.