Cisco Packet Data Network Gateway GTPv2 Tunnel Vulnerability

A vulnerability in the GPRS Tunneling Protocol for Version 2 (GTPv2) of the Cisco Packet Data Network Gateway (PGW) could allow an unauthenticated, remote attacker to cause partial availability of the GTPv2 service.

The vulnerability is due to lack of input validation of the incoming GTPv2 packet header. An attacker could exploit this vulnerability by sending a crafted, malformed GTPv2 packet to the affected device. An exploit could allow the attacker to cause a partial availability condition of the GTPv2 service.

Cisco has confirmed the vulnerability and released software updates.

To exploit this vulnerability, an attacker must be able to send malformed GTPv2 packets to the targeted device, making exploitation more difficult in environments that restrict network access from untrusted sources.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.