TI-2016-05547 Aliases CVE-2016-6466 GHSA-jwp5-v2vg-6xxj

Resource management flaw in Cisco StarOS 20.0.0 through 21.0.M0.64246

LOW 38CWE-399Published 2016-11-19 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-399 and the CVSS impact.

Summary

A vulnerability in the IPsec component of StarOS for Cisco ASR 5000 Series routers could allow an unauthenticated, remote attacker to terminate all active IPsec VPN tunnels and prevent new tunnels from establishing, resulting in a denial of service (DoS) condition. This vulnerability affects the following Cisco products: Cisco ASR 5000/5500 Series routers, Cisco Virtualized Packet Core (VPC). More Information: CSCva13631. Known Affected Releases: 20.0.0 20.1.0 20.2.0 20.2.3 20.2.v1 21.0.0 21.0.M0.64246. Known Fixed Releases: 20.2.3 20.2.3.65026 20.2.a4.65307 20.2.v1 20.2.v1.65353 20.3.M0.65037 20.3.T0.65043 21.0.0 21.0.0.65256 21.0.M0.64595 21.0.M0.64860 21.0.M0.65140 21.0.V0.65052 21.0.V0.65150 21.0.V0.65366 21.0.VC0.64639 21.1.A0.64861 21.1.A0.65145 21.1.PP0.65270 21.1.R0.65130 21.1.R0.65135 21.1.R0.65154 21.1.VC0.64898 21.1.VC0.65203 21.2.A0.65147.

Why it matters now

EPSS 0.02585 85th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Cisco StarOS 20.0.0 through 21.0.M0.64246	Cisco StarOS 20.0.0 through 21.0.M0.64246	—	No fix listed	CNA

Cisco StarOS 20.0.0 through 21.0.M0.64246 Vendor— Affected Cisco StarOS 20.0.0 through 21.0.M0.64246 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:asr_5000_series_software:20.0.0:::::::*	20.0.0	Vulnerable	Cisco
cpe:2.3:a:cisco:asr_5000_series_software:20.0.2.3:::::::*	20.0.2.3	Vulnerable	Cisco
cpe:2.3:a:cisco:asr_5000_series_software:20.0.2.v1:::::::*	20.0.2.v1	Vulnerable	Cisco
cpe:2.3:a:cisco:virtualized_packet_core:20.0_base:::::::*	20.0_base	Vulnerable	Cisco

cpe:2.3:a:cisco:asr_5000_series_software:20.0.0:*:*:*:*:*:*:* Versions 20.0.0 Vulnerable ·Cisco
cpe:2.3:a:cisco:asr_5000_series_software:20.0.2.3:*:*:*:*:*:*:* Versions 20.0.2.3 Vulnerable ·Cisco
cpe:2.3:a:cisco:asr_5000_series_software:20.0.2.v1:*:*:*:*:*:*:* Versions 20.0.2.v1 Vulnerable ·Cisco
cpe:2.3:a:cisco:virtualized_packet_core:20.0_base:*:*:*:*:*:*:* Versions 20.0_base Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2016-6466
2026-10-03 Alias added: GHSA-jwp5-v2vg-6xxj

References

Advisory 1

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161116-asr

TI-2017-02916 Access control flaw in Cisco StarOS CVSS 3.0HIGH 8.8
TI-2017-04371 Memory corruption in Cisco ASR 5000 Series Aggregation Services Routers CVSS 3.0HIGH 8.6
TI-2016-07532 Memory corruption in Cisco ASR 5000 CVSS 3.0HIGH 7.5
TI-2016-05548 Resource management flaw in Cisco Aggregation Services Router 5000 Series Switch CVSS 3.0HIGH 7.5
TI-2016-01226 The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768… CVSS 3.0HIGH 7.5
TI-2017-04430 Incorrect authorization in Cisco ASR 5000 Series Aggregation Services Routers CVSS 3.0HIGH 7.5

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences