CVE-2015-0694

2015-04-1101:59:03

CWE-284

[email protected]

web.nvd.nist.gov

cisco

asr 9000

software

vulnerability

acl

remote attackers

network-resource access restrictions

bug id

cscur28806

cve-2015-0694

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

47.8%

JSON

Cisco ASR 9000 devices with software 5.3.0.BASE do not recognize that certain ACL entries have a single-host constraint, which allows remote attackers to bypass intended network-resource access restrictions by using an address that was not supposed to have been allowed, aka Bug ID CSCur28806.

Affected configurations

NVD

Node

ciscoios_xrMatch5.3.0_base

AND

ciscoasr_9001Match-

ciscoasr_9006Match-

ciscoasr_9010Match-

ciscoasr_9904Match-

ciscoasr_9912Match-

ciscoasr_9922Match-

CPENameOperatorVersion
cisco:ios_xrcisco ios xreq5.3.0_base
cisco:asr_9001cisco asr 9001eq-
cisco:asr_9006cisco asr 9006eq-
cisco:asr_9010cisco asr 9010eq-
cisco:asr_9904cisco asr 9904eq-
cisco:asr_9912cisco asr 9912eq-
cisco:asr_9922cisco asr 9922eq-

CPE	Name	Operator	Version
cisco:ios_xr	cisco ios xr	eq	5.3.0_base
cisco:asr_9001	cisco asr 9001	eq	-
cisco:asr_9006	cisco asr 9006	eq	-
cisco:asr_9010	cisco asr 9010	eq	-
cisco:asr_9904	cisco asr 9904	eq	-
cisco:asr_9912	cisco asr 9912	eq	-
cisco:asr_9922	cisco asr 9922	eq	-