Auth bypass in Cisco Ios

CVE-2012-5032

The Flex-VPN load-balancing feature in the ipsec-ikev2 implementation in Cisco IOS before 15.1(1)SY3 does not require authentication, which allows remote attackers to trigger the forwarding of VPN traffic to an attacker-controlled destination, or the discarding of this traffic, by arranging for an arbitrary device to become a cluster member, aka Bug ID CSCub93641.

Vulnerability class: Broken Authentication

EPSS: 0.013 (67.3th percentile) — read the EPSS interpretation.

Affected products

  • Cisco Ios — versions 15.1, 15.1\(1\)sy, 15.1\(1\)sy1
  • N/a — versions n/a

Weakness classification (CWE)

References