Published: 20/04/2017 Updated: 11/07/2017
CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10
CVSS v3 Base Score: 8.6 | Impact Score: 4 | Exploitability Score: 3.9
VMScore: 694
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Vulnerability Summary

Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 up to and including 15.6) and Cisco IOS XE (3.2 up to and including 3.18) could allow an unauthenticated, remote malicious user to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted EnergyWise packets to be processed by an affected device. An exploit could allow the malicious user to cause a buffer overflow condition or a reload of the affected device, leading to a DoS condition. Cisco IOS Software and Cisco IOS XE Software support EnergyWise for IPv4 communication. Only IPv4 packets destined to a device configured as an EnergyWise domain member can trigger these vulnerabilities. IPv6 packets cannot be used to trigger these vulnerabilities. Cisco Bug ID CSCut47751.

Affected Products

Vendor Product Versions
CiscoIos12.2(33)sxi4, 12.2(33)sxi4a, 12.2(33)sxi5, 12.2(33)sxi6, 12.2(33)sxi7, 12.2(33)sxi8, 12.2(33)sxi8a, 12.2(33)sxi9, 12.2(33)sxi10, 12.2(33)sxi11, 12.2(33)sxi12, 12.2(33)sxi13, 12.2(33)sxi14, 12.2(33)sxj, 12.2(33)sxj1, 12.2(33)sxj2, 12.2(33)sxj3, 12.2(33)sxj4, 12.2(33)sxj5, 12.2(33)sxj6, 12.2(33)sxj7, 12.2(33)sxj8, 12.2(33)sxj9, 12.2(33)sxj10, 12.2(52)ex, 12.2(52)ex1, 12.2(52)ey, 12.2(52)ey1, 12.2(52)ey1b, 12.2(52)ey1c, 12.2(52)ey2, 12.2(52)ey2a, 12.2(52)ey3, 12.2(52)ey3a, 12.2(52)ey4, 12.2(53)ex, 12.2(53)ey, 12.2(53)ez, 12.2(53)se, 12.2(53)se1, 12.2(53)se2, 12.2(54)se, 12.2(54)sg, 12.2(54)sg1, 12.2(54)wo, 12.2(54)xo, 12.2(55)ex, 12.2(55)ex1, 12.2(55)ex2, 12.2(55)ex3, 12.2(55)ey, 12.2(55)ez, 12.2(55)se, 12.2(55)se1, 12.2(55)se2, 12.2(55)se3, 12.2(55)se4, 12.2(55)se5, 12.2(55)se6, 12.2(55)se7, 12.2(55)se8, 12.2(55)se9, 12.2(55)se10, 12.2(55)se11, 12.2(58)ey, 12.2(58)ey1, 12.2(58)ey2, 12.2(58)se, 12.2(58)se1, 12.2(58)se2, 12.2(60)ez, 12.2(60)ez1, 12.2(60)ez2, 12.2(60)ez3, 12.2(60)ez4, 12.2(60)ez5, 12.2(60)ez6, 12.2(60)ez7, 12.2(60)ez8, 12.2(60)ez9, 15.0(1)m2, 15.0(1)m3, 15.0(1)m4, 15.0(1)m5, 15.0(1)m6, 15.0(1)m7, 15.0(1)m8, 15.0(1)m9, 15.0(1)m10, 15.0(1)se, 15.0(1)se1, 15.0(1)se2, 15.0(1)se3, 15.0(1)sy1, 15.0(1)sy2, 15.0(1)sy3, 15.0(1)sy4, 15.0(1)sy5, 15.0(1)sy6, 15.0(1)sy7, 15.0(1)sy7a, 15.0(1)sy8, 15.0(1)sy9, 15.0(1)sy10, 15.0(1)xo, 15.0(1)xo1, 15.0(2)ed, 15.0(2)ed1, 15.0(2)eh, 15.0(2)ej, 15.0(2)ej1, 15.0(2)ek, 15.0(2)ek1, 15.0(2)ex, 15.0(2)ex1, 15.0(2)ex2, 15.0(2)ex3, 15.0(2)ex4, 15.0(2)ex5, 15.0(2)ex8, 15.0(2)ex10, 15.0(2)ez, 15.0(2)se, 15.0(2)se1, 15.0(2)se2, 15.0(2)se3, 15.0(2)se4, 15.0(2)se5, 15.0(2)se6, 15.0(2)se7, 15.0(2)se9, 15.0(2)se10, 15.0(2)sg, 15.0(2)sg1, 15.0(2)sg2, 15.0(2)sg3, 15.0(2)sg4, 15.0(2)sg5, 15.0(2)sg6, 15.0(2)sg7, 15.0(2)sg8, 15.0(2)xo, 15.0(2a)ex5, 15.0(2a)se9, 15.1(1)sg, 15.1(1)sg1, 15.1(1)sg2, 15.1(1)sy, 15.1(1)sy2, 15.1(1)sy3, 15.1(1)sy4, 15.1(1)sy5, 15.1(1)sy6, 15.1(1)t, 15.1(1)t1, 15.1(1)t2, 15.1(1)t3, 15.1(1)t4, 15.1(1)t5, 15.1(2)gc, 15.1(2)gc1, 15.1(2)gc2, 15.1(2)sg, 15.1(2)sg1, 15.1(2)sg2, 15.1(2)sg3, 15.1(2)sg4, 15.1(2)sg5, 15.1(2)sg6, 15.1(2)sg7, 15.1(2)sg8, 15.1(2)sy, 15.1(2)sy1, 15.1(2)sy2, 15.1(2)sy3, 15.1(2)sy4, 15.1(2)sy4a, 15.1(2)sy5, 15.1(2)sy6, 15.1(2)sy7, 15.1(2)sy8, 15.1(2)sy10, 15.1(2)t, 15.1(2)t0a, 15.1(2)t1, 15.1(2)t2, 15.1(2)t2a, 15.1(2)t3, 15.1(2)t4, 15.1(2)t5, 15.1(3)t, 15.1(3)t1, 15.1(3)t2, 15.1(3)t3, 15.1(3)t4, 15.1(4)gc, 15.1(4)gc1, 15.1(4)gc2, 15.1(4)m, 15.1(4)m1, 15.1(4)m2, 15.1(4)m3, 15.1(4)m3a, 15.1(4)m4, 15.1(4)m5, 15.1(4)m6, 15.1(4)m7, 15.1(4)m8, 15.1(4)m9, 15.1(4)m10, 15.2(1)e, 15.2(1)e1, 15.2(1)e2, 15.2(1)e3, 15.2(1)gc, 15.2(1)gc1, 15.2(1)gc2, 15.2(1)sy, 15.2(1)sy0a, 15.2(1)sy1, 15.2(1)sy1a, 15.2(1)sy2, 15.2(1)sy3, 15.2(1)t, 15.2(1)t1, 15.2(1)t2, 15.2(1)t3, 15.2(1)t3a, 15.2(1)t4, 15.2(2)e, 15.2(2)e1, 15.2(2)e2, 15.2(2)e4, 15.2(2)e5, 15.2(2)e5a, 15.2(2)eb, 15.2(2)eb1, 15.2(2)eb2, 15.2(2)gc, 15.2(2)sy, 15.2(2)sy1, 15.2(2)sy2, 15.2(2)t, 15.2(2)t1, 15.2(2)t2, 15.2(2)t3, 15.2(2)t4, 15.2(2a)e1, 15.2(3)e, 15.2(3)e1, 15.2(3)e2, 15.2(3)e3, 15.2(3)gc, 15.2(3)gc1, 15.2(3)t, 15.2(3)t1, 15.2(3)t2, 15.2(3)t3, 15.2(3)t4, 15.2(3a)e, 15.2(3m)e2, 15.2(4)e, 15.2(4)gc, 15.2(4)gc1, 15.2(4)gc2, 15.2(4)gc3, 15.2(4)m, 15.2(4)m1, 15.2(4)m2, 15.2(4)m3, 15.2(4)m4, 15.2(4)m5, 15.2(4)m6, 15.2(4)m6a, 15.2(4)m7, 15.2(4)m8, 15.2(4)m9, 15.2(4)m10, 15.2(4)m11, 15.3(1)sy, 15.3(1)sy2, 15.3(1)t, 15.3(1)t1, 15.3(1)t2, 15.3(1)t3, 15.3(1)t4, 15.3(2)t, 15.3(2)t1, 15.3(2)t2, 15.3(2)t3, 15.3(2)t4, 15.3(3)m, 15.3(3)m1, 15.3(3)m2, 15.3(3)m3, 15.3(3)m4, 15.3(3)m5, 15.3(3)m6, 15.3(3)m7, 15.3(3)m9, 15.4(1)cg, 15.4(1)cg1, 15.4(1)sy, 15.4(1)sy1, 15.4(1)t, 15.4(1)t1, 15.4(1)t2, 15.4(1)t3, 15.4(1)t4, 15.4(2)cg, 15.4(2)t, 15.4(2)t1, 15.4(2)t2, 15.4(2)t3, 15.4(2)t4, 15.4(3)m, 15.4(3)m1, 15.4(3)m2, 15.4(3)m3, 15.4(3)m4, 15.4(3)m5, 15.4(3)m6, 15.4(3)m6a, 15.4(3)m7, 15.5(1)t, 15.5(1)t1, 15.5(1)t2, 15.5(1)t3, 15.5(2)t, 15.5(2)t1, 15.5(2)t2, 15.5(2)t3, 15.5(2)t4, 15.5(3)m0a, 15.5(3)m1, 15.5(3)m2, 15.5(3)m4, 15.5(3)m4a, 15.5(3)m5, 15.5(3)s5, 15.6(1)t, 15.6(1)t0a, 15.6(1)t1, 15.6(1)t2, 15.6(2)t, 15.6(2)t1, 15.6(2)t2, 15.6(3)m, 15.6(3)m0a, 15.6(3)m1, 15.6(3)m1b, 15.6(3)m2
CiscoIos Xe3.2.1sg, 3.2.8sg, 3.3.1sg, 3.3.1sq, 3.4.1sg, 3.4.2sg, 3.4.3sg, 3.4.6sg, 3.4.8sg, 3.5.1e, 3.5.3e, 3.6.0e, 3.6.1e, 3.6.2ae, 3.6.2e, 3.6.4e, 3.6.5ae, 3.6.5e, 3.7.0e, 3.7.1e, 3.7.2e, 3.7.3e, 3.8.0e, 3.18.1sp

Vendor Advisories

Multiple vulnerabilities in the EnergyWise module of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined t ...