// For flags

CVE-2014-2146

 

Severity Score

6.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Zone-Based Firewall (ZBFW) functionality in Cisco IOS, possibly 15.4 and earlier, and IOS XE, possibly 3.13 and earlier, mishandles zone checking for existing sessions, which allows remote attackers to bypass intended resource-access restrictions via spoofed traffic that matches one of these sessions, aka Bug IDs CSCun94946 and CSCun96847.

La funcionalidad Zone-Based Firewall (ZBFW) en Cisco IOS, posiblemente 15.4 y versiones anteriores e IOS XE, posiblemente 3.13 y versiones anteriores, no maneja adecuadamente la zona de comprobación de las sesiones existentes, lo que permite a atacantes remotos eludir las restricciones de acceso a los recursos intencionadas a través de tráfico suplantado que coincide con una de estas sesiones, vulnerabilidad también conocida como Bug IDs CSCun94946 y CSCun96847.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2014-02-25 CVE Reserved
  • 2016-09-22 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-08-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Ios
Search vendor "Cisco" for product "Ios"
 <= 15.4\(1\)t1
Search vendor "Cisco" for product "Ios" and version " <= 15.4\(1\)t1"
-
Affected
Cisco
Search vendor "Cisco"
 Ios Xe
Search vendor "Cisco" for product "Ios Xe"
 <= 15.4\(3\)s
Search vendor "Cisco" for product "Ios Xe" and version " <= 15.4\(3\)s"
-
Affected