CVE-2014-3396: High severity cisco ios xrv 9000 vulnerability
Published Oct 5, 2014
·Updated
Cisco IOS XR on ASR 9000 devices does not properly use compression for port-range and address-range encoding, which allows remote attackers to bypass intended Typhoon line-card ACL restrictions via transit traffic, aka Bug ID CSCup30133.
Affected Software
8 affected components
Cisco IOS XR
Cisco Asr 9000 Rsp440 Router
Cisco Asr 9001
Cisco Asr 9006
Cisco Asr 9010
Cisco Asr 9904
Cisco Asr 9912
Cisco Asr 9922
Event History
Oct 5, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-3396?
CVE-2014-3396 is considered a moderate severity vulnerability allowing bypass of ACL restrictions.
2
How do I fix CVE-2014-3396?
To mitigate CVE-2014-3396, apply the latest patches provided by Cisco for affected IOS XR versions.
3
Which devices are affected by CVE-2014-3396?
CVE-2014-3396 affects various Cisco ASR 9000 series devices running affected versions of IOS XR.
4
Can CVE-2014-3396 be exploited remotely?
Yes, CVE-2014-3396 can be exploited remotely via transit traffic by unauthorized attackers.
5
What are the potential impacts of CVE-2014-3396?
The potential impact of CVE-2014-3396 includes unauthorized access and manipulation of network traffic due to ACL bypass.