Cisco IOS Software and Cisco IOS XE Software Crafted RADIUS Packet Denial of Service Vulnerability

A vulnerability in Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition.

The vulnerability is due to improper processing of crafted RADIUS packets by a device running the affected software. An authenticated, remote attacker could exploit this vulnerability by sending crafted RADIUS packets to an affected device. If successful, the attacker could cause the device to crash, resulting in a DoS condition.

Cisco has confirmed the vulnerability and released software updates.

To exploit this vulnerability, an attacker must authenticate to the affected device. This access requirement decreases the likelihood of a successful exploit.

An attacker may need to obtain additional information about the affected device such as whether the device is configured with RADIUS Proxy. In addition, the attacker must also know the RADIUS secret.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.