Exploited vulnerability · CISA KEV

Is CVE-2016-6415 exploited? Yes: in CISA KEV since 19 May 2023

Gociux · Cisco IOS, IOS XR, and IOS XE · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2016-6415, Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 19 May 2023, 2433 days after it was published. It affects Cisco IOS, IOS XR, and IOS XE, an internet-facing product of the kind attackers use for initial access. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure.

What to do

1. Check whether you run it. Look for IOS, IOS XR, and IOS XE in your asset inventory, including appliances and cloud images. Stack check lists every exploited Cisco CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 19 Sep 2016.
4. Get told next time. Email alerts when CISA adds a CVE for Cisco.

References

• sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2016
• nvd.nist.gov/vuln/detail/CVE-2016-6415

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in May 2023 · Cisco scorecard · act-now radar.