CVE-2016-6415

cisco ios, cisco ios xe, cisco ios xr

Published 19 Sept 2016 · updated 17 Jun 2026 · Analyzed

7.5 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 19 May 2023, with a remediation deadline of 9 Jun 2023 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1 · Vendor Advisory
www.securityfocus.com/bid/93003 · Third Party Advisory, VDB Entry
www.securitytracker.com/id/1036841 · Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6415 · US Government Resource