Read the docs
TI-2016-05497 Aliases CVE-2016-6415GHSA-ccm6-q86p-2hwx

The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS…

Priority CRITICAL 90Exploited in the wildCWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-200.

Summary

The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.

Why it matters now

Exploitation Active In CISA KEV since 2023-05-19CISA due date 2023-06-09
EPSS 0.87687 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*12.2 – 12.4; 15.0 – 15.6VulnerableCisco
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*up to 3.18sVulnerableCisco
cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*4.3.0 – 4.3.4; 5.0.0 to before 5.3.0VulnerableCisco
  • cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:* Versions 12.2 – 12.4; 15.0 – 15.6 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:* Versions up to 3.18s Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:* Versions 4.3.0 – 4.3.4; 5.0.0 to before 5.3.0 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2023-05-19 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2016-6415
  3. 2026-10-03 Alias added: GHSA-ccm6-q86p-2hwx

References

Advisory 1

  • TI-2018-00138 Improper input validation in Cisco IOS and IOS XE KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09019 Improper input validation in Cisco IOS and IOS XE KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-02977 Improper input validation in Cisco IOS and IOS XE Software KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-00135 Memory corruption in Cisco IOS, IOS XE, and IOS XR KEVCVSS 3.1HIGH 8.8
  • TI-2017-04499 Memory corruption in Cisco IOS KEVCVSS 3.1HIGH 8.8
  • TI-2017-04498 Memory corruption in Cisco IOS KEVCVSS 3.1HIGH 8.8
See all 617 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences