Live › vulnerability › CVE-2016-6415
Go to dashboardCisco IOS, IOS XR and IOS XE contain an IKEv1 flaw in how security negotiation requests are handled, letting an attacker read device memory. The disclosed memory can expose sensitive data held by the router, and CISA lists it as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Cisco IOS, IOS XR, and IOS XE | vendor | – | – |
| cisco ios | vendor | >= 12.2, <= 12.4 | – |
| cisco ios | vendor | >= 15.0, <= 15.6 | – |
| cisco ios xe | vendor | <= 3.18s | – |
| cisco ios xr | vendor | >= 4.3.0, <= 4.3.4 | – |
| cisco ios xr | vendor | >= 5.0.0, < 5.3.0 | 5.3.0 |
show version on each Cisco IOS, IOS XR or IOS XE device and compare against the fixed releases in Cisco's advisoryshow crypto isakmp policy or show crypto isakmp saEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2016-6415")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.