7.5high
CVE-2016-9205
A vulnerability in the HTTP 2.0 request handling code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
0
none known
Summary
A vulnerability in the HTTP 2.0 request handling code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon (emsd) to crash, resulting in a denial of service (DoS) condition. More Information: CSCvb14425. Known Affected Releases: 6.1.1.BASE. Known Fixed Releases: 6.1.2.6i.MGBL 6.1.22.9i.MGBL 6.2.1.14i.MGBL.
Exploit prediction (EPSS)
1.59% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected products
- n/a Cisco IOS XR
Classification
- Weakness
- CWE-399 Resource Management Errors
- Technology feeds
- Cisco IOS (RSS, critical only)
References
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-ios-xr · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/94813 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2016-9205
- NVD: CVE-2016-9205
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.