CVE-2004-1464mediumunder attackCWE-400

CVE-2004-1464

Published · Updated

Follow this CVE+ Monitor IOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 5.9epss 4.8%
from disclosure to weapon
Published on NVDFeb 13
CISA KEV+6669d
Action required by CISAfederal deadline: 2023-06-09

Apply updates per vendor instructions.

In short

A flaw in Cisco IOS allows attackers to block legitimate users from connecting to network devices via Telnet by sending specially crafted network packets. This prevents administrators from managing the device remotely.

Technical detail

A resource exhaustion vulnerability in Cisco IOS 12.2(15) and earlier fails to properly handle malformed TCP connections to Telnet ports, causing VTY (virtual terminal) connection refusal. Remote unauthenticated attackers can trigger a denial of service condition affecting device management accessibility.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or reverse Telnet port.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · n/a