Back to CVE Browser

CVE-2016-6415

Known Exploited (CISA KEV)HIGH

7.5

CVSS Severity Score

EPSS Score95.8500%

EPSS Percentile96.27th

PublishedSep 19, 2016

Last ModifiedApr 22, 2026

Vulnerability Description

The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.

Affected Platforms (CPE)

💻

Cisco

Ios

>= 12.2 and <= 12.4

💻

Cisco

Ios

>= 15.0 and <= 15.6

💻

Cisco

Ios Xe

<= 3.18s

💻

Cisco

Ios Xr

>= 4.3.0 and <= 4.3.4

💻

Cisco

Ios Xr

>= 5.0.0 and < 5.3.0

References & Advisories

🔗 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1

🔗 http://www.securityfocus.com/bid/93003

🔗 http://www.securitytracker.com/id/1036841

🔗 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1

🔗 http://www.securityfocus.com/bid/93003

🔗 http://www.securitytracker.com/id/1036841

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6415

Related Vulnerabilities

CVE-2019-1264310.0

A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated, remote a...

CVE-2018-431010.0

An access issue was addressed with additional sandbox restrictions. This issue affected versions prior to iOS 12, macOS Mojave 10....

CVE-2019-623510.0

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12...

CVE-2019-1106310.0

A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an...