{"id":"CVE-2016-6415","kind":"vulnerability","aliases":["CVE-2016-6415"],"related":[],"title":"The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR…","description":"Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Cisco IOS, IOS XR and IOS XE contain an IKEv1 flaw in how security negotiation requests are handled, letting an attacker read device memory. The disclosed memory can expose sensitive data held by the router, and CISA lists it as actively exploited.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2023-05-19T00:00:00+00:00","products":[{"name":"Cisco IOS, IOS XR, and IOS XE","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"cisco ios","fixed":[],"affected":">= 12.2, <= 12.4","ecosystem":"vendor"},{"name":"cisco ios","fixed":[],"affected":">= 15.0, <= 15.6","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"<= 3.18s","ecosystem":"vendor"},{"name":"cisco ios xr","fixed":[],"affected":">= 4.3.0, <= 4.3.4","ecosystem":"vendor"},{"name":"cisco ios xr","fixed":["5.3.0"],"affected":">= 5.0.0, < 5.3.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","exploited","infrastructure","ios","ios-xe","ios-xr","routers","vpn"],"not_affected_if":["ikev1-disabled","non-cisco-hardware"],"how_to_check":"Run 'show version' on each Cisco IOS, IOS XR or IOS XE device and compare against the fixed releases in Cisco's advisory.\nCheck whether IKEv1 is enabled, for example with 'show crypto isakmp policy' or 'show crypto isakmp sa'.","fix":"Apply the Cisco software update for your platform per vendor instructions, as CISA requires.\nIf IKEv1 is not needed, disabling it is the mitigation the sources imply but do not detail: unknown.","status":"open","published_at":"2016-09-19T01:59:06+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:44+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:06:44Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Cisco software update for your platform per vendor instructions, as CISA requires.\nIf IKEv1 is not needed, disabling it is the mitigation the sources imply but do not detail: unknown.","reach":"network","impact":"medium","summary":"Cisco IOS, IOS XR and IOS XE contain an IKEv1 flaw in how security negotiation requests are handled, letting an attacker read device memory. The disclosed memory can expose sensitive data held by the router, and CISA lists it as actively exploited.","category":"infrastructure","who_cares":["cisco","ios","ios-xe","ios-xr","vpn","routers"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads device memory, possibly exposing credentials or session secrets","analyst_note":"Confirm affected and fixed versions and the IKEv1 mitigation from the Cisco advisory for CVE-2016-6415; the sources give no version list.","how_to_check":"Run 'show version' on each Cisco IOS, IOS XR or IOS XE device and compare against the fixed releases in Cisco's advisory.\nCheck whether IKEv1 is enabled, for example with 'show crypto isakmp policy' or 'show crypto isakmp sa'.\nunknown for the exact affected version list in the sources.","needs_analyst":true,"not_affected_if":["ikev1-disabled","non-cisco-hardware"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00056,"input_tokens":2934,"output_tokens":533,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2016':23A,26A '-6415':24A,27A '1':125C,141C '12.2':8A '12.4':10A '15.0':12A '15.6':14A '3.18':18A 'action':170C 'activ':100B 'allow':145C,155C 'and':32A 'appli':171C 'attack':80B,147C,157C 'check':112C 'cisa':96B,168C 'cisco':6A,28A,35A,37A,39A,42A,45A,48B,60B,102C 'code':118C 'condit':111C 'contain':67B,109C,130C 'content':151C,161C 'could':144C,154C 'cve':22A,25A 'data':90B 'devic':82B 'disclos':85B 'disclosur':133C,167C 'exchang':123C,139C 'exploit':49B,101B,153C 'expos':88B 'flaw':70B 'handl':77B,120C 'held':91B 'ikev1':3A,69B,126C,142C 'implement':4A 'inform':132C,166C 'infrastructur':50B 'instruct':175C 'insuffici':110C 'internet':121C,137C 'io':7A,15A,20A,51B,53B,56B,61B,62B,65B,103C,104C,107C 'ios':29A,30A,33A,36A,38A,40A,43A,46A 'ios-x':52B 'ios-xr':55B 'key':122C,138C 'lead':164C 'let':78B 'list':97B 'memori':83B,86B,150C,160C 'negoti':74B,128C 'part':115C 'per':173C 'read':81B 'request':75B,129C 'requir':169C 'retriev':149C,159C 'router':58B,94B 'secur':73B,127C 'sensit':89B 'server':2A 'success':152C 'updat':172C 'vendor':174C 'version':124C,140C 'vpn':59B 'vulner':134C 'xe':16A,34A,41A,54B,66B,108C 'xr':21A,31A,44A,47A,57B,63B,105C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-09-19T01:59:06+00:00","kev":{"dateAdded":"2023-05-19","dueDate":"2023-06-09","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-6415","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-6415","severity":null,"published_at":"2023-05-19T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-6415","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6415","severity":null,"published_at":"2016-09-19T01:59:06+00:00","modified_at":"2026-06-17T00:50:59+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}