Published: 26/03/2016 Updated: 03/12/2016

CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 694

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

The Smart Install client implementation in Cisco IOS 12.2, 15.0, and 15.2 and IOS XE 3.2 up to and including 3.7 allows remote malicious users to cause a denial of service (device reload) via crafted image list parameters in a Smart Install packet, aka Bug ID CSCuv45410.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cisco ios xe 3.3se_3.3.3se
cisco ios xe 3.3se_3.3.2se
cisco ios xe 3.4sg_3.4.3sg
cisco ios xe 3.3xo_3.3.2xo
cisco ios xe 3.7e_3.7.1e
cisco ios xe 3.6e_3.6.2ae
cisco ios xe 3.6e_3.6.1e
cisco ios xe 3.6e_3.6.0e
cisco ios xe 3.5e_3.5.3e
cisco ios xe 3.3xo_3.3.1xo
cisco ios xe 3.5e_3.5.0e
cisco ios xe 3.2se_3.2.1se
cisco ios xe 3.3xo_3.3.0xo
cisco ios 12.2\\\\\\(60\\\\\\)ez8
cisco ios 12.2\\\\\\(60\\\\\\)ez7
cisco ios 15.2\\\\\\(3\\\\\\)e1
cisco ios 12.2\\\\\\(60\\\\\\)ez5
cisco ios 12.2\\\\\\(60\\\\\\)ez4
cisco ios 15.0\\\\\\(2\\\\\\)ej1
cisco ios 15.2\\\\\\(1\\\\\\)e1
cisco ios 15.0\\\\\\(2\\\\\\)ex4
cisco ios 15.0\\\\\\(2\\\\\\)se5
cisco ios 15.0\\\\\\(2\\\\\\)eh
cisco ios 12.2\\\\\\(60\\\\\\)ez
cisco ios 15.0\\\\\\(2\\\\\\)se3
cisco ios 12.2\\\\\\(55\\\\\\)se7
cisco ios 15.2\\\\\\(1\\\\\\)e
cisco ios 12.2\\\\\\(55\\\\\\)se6
cisco ios 15.0\\\\\\(1\\\\\\)se2
cisco ios 12.2\\\\\\(58\\\\\\)se2
cisco ios 12.2\\\\\\(55\\\\\\)ex2
cisco ios 12.2\\\\\\(50\\\\\\)se
cisco ios 12.2\\\\\\(25\\\\\\)seg6
cisco ios 12.2\\\\\\(46\\\\\\)se1
cisco ios 12.2\\\\\\(46\\\\\\)ex
cisco ios 12.2\\\\\\(44\\\\\\)se6
cisco ios 12.2\\\\\\(25\\\\\\)seg1
cisco ios 12.2\\\\\\(40\\\\\\)se1
cisco ios 15.2\\\\\\(2\\\\\\)ea1
cisco ios xe 3.7e_3.7.2e
cisco ios 12.2\\\\\\(25\\\\\\)seg4
cisco ios 12.2\\\\\\(44\\\\\\)se
cisco ios 12.2\\\\\\(53\\\\\\)ey
cisco ios 12.2\\\\\\(44\\\\\\)se4
cisco ios 12.2\\\\\\(44\\\\\\)ex1
cisco ios 12.2\\\\\\(44\\\\\\)se1
cisco ios 12.2\\\\\\(35\\\\\\)se4
cisco ios 12.2\\\\\\(44\\\\\\)se2
cisco ios 12.2\\\\\\(40\\\\\\)ex3
cisco ios 12.2\\\\\\(44\\\\\\)ex
cisco ios 12.2\\\\\\(25\\\\\\)seg5
cisco ios 12.2\\\\\\(55\\\\\\)ey
cisco ios xe 3.3se_3.3.5se
cisco ios xe 3.3se_3.3.4se
cisco ios xe 3.4sg_3.4.5sg
cisco ios xe 3.4sg_3.4.4sg
cisco ios xe 3.4sg_3.4.2sg
cisco ios xe 3.4sg_3.4.0sg
cisco ios 15.2\\\\\\(3m\\\\\\)e3
cisco ios 15.2\\\\\\(2\\\\\\)eb1
cisco ios 15.0\\\\\\(2\\\\\\)ex8
cisco ios 15.2\\\\\\(2a\\\\\\)e1
cisco ios 15.2\\\\\\(1\\\\\\)e3
cisco ios 12.2\\\\\\(55\\\\\\)se10
cisco ios 15.0\\\\\\(2\\\\\\)ex5
cisco ios 15.0\\\\\\(2\\\\\\)se6
cisco ios 15.0\\\\\\(2\\\\\\)ed1
cisco ios 12.2\\\\\\(55\\\\\\)se9
cisco ios 12.2\\\\\\(60\\\\\\)ez1
cisco ios 15.0\\\\\\(2\\\\\\)ez
cisco ios 15.0\\\\\\(2\\\\\\)ex
cisco ios 15.0\\\\\\(2\\\\\\)ey
cisco ios 15.0\\\\\\(1\\\\\\)ey2
cisco ios 15.0\\\\\\(2\\\\\\)se2
cisco ios 15.0\\\\\\(1\\\\\\)ey1
cisco ios 12.2\\\\\\(55\\\\\\)se5
cisco ios 12.2\\\\\\(58\\\\\\)ey1
cisco ios 12.2\\\\\\(58\\\\\\)se1
cisco ios 12.2\\\\\\(55\\\\\\)ex1
cisco ios 12.2\\\\\\(55\\\\\\)ez
cisco ios 12.2\\\\\\(50\\\\\\)se4
cisco ios 12.2\\\\\\(53\\\\\\)se2
cisco ios 12.2\\\\\\(40\\\\\\)ex1
cisco ios 12.2\\\\\\(55\\\\\\)se1
cisco ios 15.2\\\\\\(3\\\\\\)e2
cisco ios 12.2\\\\\\(50\\\\\\)se3
cisco ios 12.2\\\\\\(58\\\\\\)se
cisco ios 12.2\\\\\\(55\\\\\\)se2
cisco ios xe 3.4sg_3.4.6sg
cisco ios xe 3.7e_3.7.0e
cisco ios xe 3.5e_3.5.2e
cisco ios xe 3.5e_3.5.1e
cisco ios xe 3.3se_3.3.1se
cisco ios xe 3.4sg_3.4.1sg
cisco ios xe 3.3se_3.3.0se
cisco ios xe 3.2se_3.2.0se
cisco ios 15.2\\\\\\(2\\\\\\)e3
cisco ios 15.0\\\\\\(2a\\\\\\)ex5
cisco ios 15.0\\\\\\(2\\\\\\)se7
cisco ios 15.2\\\\\\(2\\\\\\)e1
cisco ios 15.0\\\\\\(2\\\\\\)ek1
cisco ios 15.2\\\\\\(2\\\\\\)eb
cisco ios 15.0\\\\\\(2\\\\\\)ex3
cisco ios 12.2\\\\\\(60\\\\\\)ez2
cisco ios 15.0\\\\\\(2\\\\\\)ej
cisco ios 15.2\\\\\\(1\\\\\\)ey
cisco ios 12.2\\\\\\(55\\\\\\)se8
cisco ios 15.0\\\\\\(2\\\\\\)ex1
cisco ios 15.0\\\\\\(2\\\\\\)eb
cisco ios 15.0\\\\\\(2\\\\\\)ec
cisco ios 12.2\\\\\\(58\\\\\\)ex
cisco ios 12.2\\\\\\(58\\\\\\)ey2
cisco ios 12.2\\\\\\(58\\\\\\)ey
cisco ios 15.0\\\\\\(1\\\\\\)ex
cisco ios 12.2\\\\\\(55\\\\\\)se4
cisco ios 12.2\\\\\\(25\\\\\\)sed1
cisco ios 12.2\\\\\\(25\\\\\\)seg3
cisco ios 12.2\\\\\\(52\\\\\\)se1
cisco ios 12.2\\\\\\(55\\\\\\)ex
cisco ios 12.2\\\\\\(35\\\\\\)se2
cisco ios 12.2\\\\\\(37\\\\\\)ey
cisco ios xe 3.6e_3.6.2e
cisco ios xe 3.2ja_3.2.0ja
cisco ios 12.2\\\\\\(40\\\\\\)se
cisco ios 12.2\\\\\\(35\\\\\\)ex1
cisco ios 12.2\\\\\\(35\\\\\\)se3
cisco ios 12.2\\\\\\(52\\\\\\)ex
cisco ios 12.2\\\\\\(25\\\\\\)seg2
cisco ios 12.2\\\\\\(50\\\\\\)se5
cisco ios 15.0\\\\\\(1\\\\\\)ey
cisco ios 12.2\\\\\\(35\\\\\\)ex2
cisco ios 12.2\\\\\\(46\\\\\\)se
cisco ios 12.2\\\\\\(40\\\\\\)se2
cisco ios 12.2\\\\\\(25\\\\\\)see3
cisco ios 12.2\\\\\\(37\\\\\\)se
cisco ios 12.2\\\\\\(25\\\\\\)seg
cisco ios 12.2\\\\\\(25\\\\\\)see
cisco ios 15.0\\\\\\(1\\\\\\)se
cisco ios 12.2\\\\\\(44\\\\\\)ey
cisco ios 12.2\\\\\\(37\\\\\\)ex
cisco ios 12.2\\\\\\(53\\\\\\)ex
cisco ios 12.2\\\\\\(35\\\\\\)se1
cisco ios 12.2\\\\\\(25\\\\\\)see4
cisco ios 12.2\\\\\\(50\\\\\\)se1
cisco ios 12.2\\\\\\(25\\\\\\)sef3
cisco ios 12.2\\\\\\(55\\\\\\)se
cisco ios 12.2\\\\\\(35\\\\\\)ex
cisco ios 12.2\\\\\\(25\\\\\\)sed
cisco ios 12.2\\\\\\(46\\\\\\)ey
cisco ios 12.2\\\\\\(25\\\\\\)see1
cisco ios 12.2\\\\\\(25\\\\\\)fz
cisco ios xe 3.2se_3.2.3se
cisco ios xe 3.2se_3.2.2se
cisco ios 15.2\\\\\\(3m\\\\\\)e2
cisco ios 15.2\\\\\\(3\\\\\\)ea
cisco ios 15.2\\\\\\(2\\\\\\)ea2
cisco ios 15.2\\\\\\(2\\\\\\)e2
cisco ios 12.2\\\\\\(60\\\\\\)ez6
cisco ios 15.2\\\\\\(1\\\\\\)e2
cisco ios 15.2\\\\\\(3\\\\\\)e
cisco ios 15.0\\\\\\(2\\\\\\)ek
cisco ios 12.2\\\\\\(60\\\\\\)ez3
cisco ios 15.0\\\\\\(2\\\\\\)ey3
cisco ios 15.0\\\\\\(2\\\\\\)ex2
cisco ios 15.0\\\\\\(2\\\\\\)ey2
cisco ios 15.0\\\\\\(2\\\\\\)se4
cisco ios 15.0\\\\\\(2\\\\\\)ey1
cisco ios 15.2\\\\\\(2\\\\\\)e
cisco ios 15.0\\\\\\(2\\\\\\)ed
cisco ios 15.0\\\\\\(2\\\\\\)se1
cisco ios 15.0\\\\\\(1\\\\\\)se3
cisco ios 12.2\\\\\\(55\\\\\\)ex3
cisco ios 15.0\\\\\\(1\\\\\\)se1
cisco ios 15.0\\\\\\(2\\\\\\)se
cisco ios 12.2\\\\\\(52\\\\\\)ex1
cisco ios 12.2\\\\\\(44\\\\\\)se5
cisco ios 12.2\\\\\\(54\\\\\\)se
cisco ios 12.2\\\\\\(44\\\\\\)se3
cisco ios 12.2\\\\\\(40\\\\\\)ex2
cisco ios 15.2\\\\\\(3a\\\\\\)e
cisco ios 15.2\\\\\\(2a\\\\\\)e2
cisco ios 12.2\\\\\\(52\\\\\\)se
cisco ios 12.2\\\\\\(25\\\\\\)see2
cisco ios 12.2\\\\\\(53\\\\\\)ez
cisco ios 12.2\\\\\\(55\\\\\\)se3
cisco ios 12.2\\\\\\(37\\\\\\)se1
cisco ios 12.2\\\\\\(53\\\\\\)se
cisco ios 12.2\\\\\\(58\\\\\\)ez
cisco ios 12.2\\\\\\(40\\\\\\)ex
cisco ios 12.2\\\\\\(35\\\\\\)se5
cisco ios 12.2\\\\\\(50\\\\\\)se2
cisco ios 12.2\\\\\\(46\\\\\\)se2
cisco ios 12.2\\\\\\(25\\\\\\)sef2
cisco ios 12.2\\\\\\(53\\\\\\)se1
cisco ios 12.2\\\\\\(25\\\\\\)sef1
cisco ios 12.2\\\\\\(35\\\\\\)se

The Smart Install client feature in Cisco IOS and IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device The vulnerability is due to incorrect handling of image list parameters An attacker could exploit this vulnerability by sending crafted ...

In recent weeks, Cisco has published several documents related to the Smart Install feature: one Talos blog about potential misuse of the feature if left enabled, and two Cisco Security Advisories that were included in the March 2018 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication Given the heightened awareness, ...

CWE-399 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-smi http://www.securitytracker.com/id/1035385 https://nvd.nist.gov http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-smi

Get Started

CVE-2016-1349

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect