CVE-2017-6627

mediumPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEPSS 0.062 · 93. PerzentilEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV

Likely / severe?

6.16% (93rd) EPSS

CVSS 5 · medium

Is it mine?

120 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisco_csaf

hinzugefügt 2022-03-03beheben bis 2022-03-24

erforderliche Maßnahme Apply updates per vendor instructions.

EPSS · bewertet 2026-10-26

Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability

A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and a denial of service (DoS) condition. The vulnerability is due to Cisco IOS Software application changes that create UDP sockets and leave the sockets idle without closing them. An attacker could exploit this vulnerability by sending UDP packets with a destination port of 0 to an affected device. A successful exploit could allow the attacker to cause UDP packets to be held in the input interfaces queue, resulting in a DoS condition. The input interface queue will stop holding UDP packets when it receives 250 packets. Cisco Bug IDs: CSCup10024, CSCva55744, CSCva95506.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behoben3.14.0Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.14.1Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.14.2Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.14.3Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.14.4Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.15.0Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.15.1Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.15.1cScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.15.2Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.15.3Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.15.4Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.0Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.0aScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.0bScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.0cScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.1Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.1aScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.2Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.2aScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.2bScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.3Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.3aScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.4Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.4aScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.4bScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.4cScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.4dScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.4eScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.4gScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.5Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.5aScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.5bScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.16.6Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.17.0Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.17.1Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.17.1aScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.17.2Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.17.3Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.18.0Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.18.0aScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.18.1Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.18.2Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben3.18.3Scisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco IOScisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Workaround3.14.0Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.14.1Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.14.2Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.14.3Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.14.4Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.15.0Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.15.1Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.15.1cScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.15.2Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.15.3Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.15.4Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.0Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.0aScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.0bScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.0cScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.1Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.1aScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.2Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.2aScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.2bScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.3Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.3aScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.4Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.4aScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.4bScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.4cScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.4dScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.4eScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.4gScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.5Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.5aScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.5bScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.16.6Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.17.0Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.17.1Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.17.1aScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.17.2Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.17.3Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.18.0Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.18.0aScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.18.1Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.18.2Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
Workaround3.18.3Scisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0
WorkaroundCisco IOScisco_csaf
To work around this vulnerability, administrators can set a maximum hold queue value that is greater than 250 for all device interfaces. The following example shows how to set the value to 350 by using the hold queue in interface configuration command: Router# configure terminal Router(config)# interface gigabitEthernet 1 Router(config-if)# hold-queue 350 in Administrators can also configure an access-control list (ACL) that blocks UDP packets with a destination port of 0 and apply the ACL to all device interfaces, for example: Extended IP access list 180 10 deny udp any any eq 0

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · Cisco PSIRT US

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HsecondaryAusnutzbarkeit 3.9 · Auswirkung 3.6

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: active · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-404USprimärCWE-399USCWE-399US

betroffene Produkte (120)

Betroffene Produkte und Versionsbereiche.

Cisco 3.14.0Salle Versionencisco_csafUS
Cisco 3.14.1Salle Versionencisco_csafUS
Cisco 3.14.2Salle Versionencisco_csafUS
Cisco 3.14.3Salle Versionencisco_csafUS
Cisco 3.14.4Salle Versionencisco_csafUS
Cisco 3.15.0Salle Versionencisco_csafUS
Cisco 3.15.1Salle Versionencisco_csafUS
Cisco 3.15.1cSalle Versionencisco_csafUS
Cisco 3.15.2Salle Versionencisco_csafUS
Cisco 3.15.3Salle Versionencisco_csafUS
Cisco 3.15.4Salle Versionencisco_csafUS
Cisco 3.16.0Salle Versionencisco_csafUS
Cisco 3.16.0aSalle Versionencisco_csafUS
Cisco 3.16.0bSalle Versionencisco_csafUS
Cisco 3.16.0cSalle Versionencisco_csafUS
Cisco 3.16.1Salle Versionencisco_csafUS
Cisco 3.16.1aSalle Versionencisco_csafUS
Cisco 3.16.2Salle Versionencisco_csafUS
Cisco 3.16.2aSalle Versionencisco_csafUS
Cisco 3.16.2bSalle Versionencisco_csafUS

20 von 120 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

cisco-sa-20170906-ios-udpCisco IOS and Cisco IOS XE Software UDP Packet Processing Denial of Service Vulnerability2017-09-06csaf · cisco_csafUS
A vulnerability in the UDP processing code of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and a denial of service (DoS) condition. The vulnerability is due to Cisco IOS Software application changes that create UDP sockets and leave the sockets idle without closing them. An attacker could exploit this vulnerability by sending UDP packets with a destination port of 0 to an affected device. A successful exploit could allow the attacker to cause UDP packets to be held in the input interfaces queue, resulting in a DoS condition. The input interface queue will stop holding UDP packets when it receives 250 packets. There are workarounds that address this vulnerability.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisco_csaf NVD CVE.org MITRE

veröffentlicht 2017-09-07geändert 2026-06-17

verwandt (2,015)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2023-38180US	—OT kritisch	14.1% (97th)	KEV	2023-08-08
.NET and Visual Studio Denial of Service Vulnerability
CVE-2018-8639US	high7.8OT kritisch	22.2% (98th)	KEV	2018-12-12
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." T…
CVE-2018-8611US	high7.8OT kritisch	4.20% (91st)	KEV	2018-12-12
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This a…
CVE-2018-8406US	high7.8OT kritisch	3.44% (89th)	KEV	2018-08-15
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Pri…
CVE-2018-8405US	high7.8OT kritisch	3.44% (89th)	KEV	2018-08-15
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Pri…

+2010 weitere

Referenzen (10)

Externe Belege — Patches, Meldungen, Analysen.

http://www.securitytracker.com/id/1039289 cnnvd
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-ios-udp cnnvd
https://www.securityfocus.com/bid/100644 cnnvd
http://www.securityfocus.com/bid/100644 enisa_euvd
http://www.securitytracker.com/id/1039289 enisa_euvd
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-ios-udp enisa_euvd
http://www.securityfocus.com/bid/100644Broken LinkThird Party AdvisoryVDB Entrynvd
http://www.securitytracker.com/id/1039289Broken LinkThird Party AdvisoryVDB Entrynvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan