CVE-2015-6366: Medium severity cisco ios vulnerability

Published Nov 13, 2015

Updated

Cisco IOS 15.2(04)M6 and 15.4(03)S lets physical-interface ACLs supersede tunnel-interface ACLs, which allows remote attackers to bypass intended network-traffic restrictions in opportunistic circumstances by using a tunnel, aka Bug ID CSCur01042.

Affected Software

2 affected components

Cisco IOS=15.2\(4\)m6

Cisco IOS=15.4\(3\)s

Event History

Nov 13, 2015

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6366?

The severity of CVE-2015-6366 is considered to be high due to the potential for remote attackers to bypass network traffic restrictions.

How do I fix CVE-2015-6366?

To fix CVE-2015-6366, you should upgrade to a Cisco IOS version that is not affected, such as the latest recommended stable release.

What systems are affected by CVE-2015-6366?

CVE-2015-6366 affects Cisco IOS versions 15.2(04)M6 and 15.4(03)S.

What are the implications of CVE-2015-6366 for network security?

The implications of CVE-2015-6366 include the possibility for attackers to exploit tunneling techniques to evade access control lists, leading to unauthorized access.

Is there a workaround for CVE-2015-6366?

While upgrading is recommended, one potential workaround is to review and tighten existing ACL rules to mitigate the risk of exploitation.