Design/Logic Flaw

Cisco IOS 15.204M6 and 15.403S lets physical-interface ACLs supersede tunnel-interface ACLs, which allows remote attackers to bypass intended network-traffic restrictions in opportunistic circumstances by using a tunnel, aka Bug ID CSCur01042...

CVE-2015-6366

CVE-2015-6366 affects Cisco IOS (versions 15.2(04)M6 and 15.4(03)S). The root cause is that physical-interface ACLs can supersede tunnel-interface ACLs, allowing an unauthenticated, remote user connected to a tunnel to bypass traffic restrictions. Impact is described as bypassing intended network...