What is CVE-2016-6466?

CVE-2016-6466 is a high-severity vulnerability in Cisco Asr 5000 Series Software, classified under CWE-399. CVSS score: 7.5/10. Published 2016-11-19.

How severe is CVE-2016-6466?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Cisco Asr 5000 Series Software

CVE-2016-6466

A vulnerability in the IPsec component of StarOS for Cisco ASR 5000 Series routers could allow an unauthenticated, remote attacker to terminate all active IPsec VPN tunnels and prevent new tunnels from establishing, resulting in a denial of service (DoS) condition. This vulnerability affects the following Cisco products: Cisco ASR 5000/5500 Series routers, Cisco Virtualized Packet Core (VPC). More Information: CSCva13631. Known Affected Releases: 20.0.0 20.1.0 20.2.0 20.2.3 20.2.v1 21.0.0 21.0.M0.64246. Known Fixed Releases: 20.2.3 20.2.3.65026 20.2.a4.65307 20.2.v1 20.2.v1.65353 20.3.M0.65037 20.3.T0.65043 21.0.0 21.0.0.65256 21.0.M0.64595 21.0.M0.64860 21.0.M0.65140 21.0.V0.65052 21.0.V0.65150 21.0.V0.65366 21.0.VC0.64639 21.1.A0.64861 21.1.A0.65145 21.1.PP0.65270 21.1.R0.65130 21.1.R0.65135 21.1.R0.65154 21.1.VC0.64898 21.1.VC0.65203 21.2.A0.65147.

Published 2016-11-19 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.026 (85.0th percentile), scored 2026-10-20.

Low probability of exploitation in the next 30 days, but still tracked. 85th percentile — 85.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.026 · newest: 0.026 · change: 0.000

Affected products

Cisco Asr 5000 Series Software — versions 20.0.0, 20.0.2.3, 20.0.2.v1
Cisco Virtualized Packet Core — versions 20.0_base
Cisco Staros 20.0.0 Through 21.0.m0.64246 — versions Cisco StarOS 20.0.0 through 21.0.M0.64246

Weakness classification (CWE)

CWE-399

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161116… (Vendor Advisory)
www.securitytracker.com/id/1037308 (vdb-entry)
www.securityfocus.com/bid/94361 (vdb-entry)

Frequently asked questions

What is CVE-2016-6466?: CVE-2016-6466 is a high-severity vulnerability in Cisco Asr 5000 Series Software, classified under CWE-399. CVSS score: 7.5/10. Published 2016-11-19.
How severe is CVE-2016-6466?: High severity. CVSS v3 base score is 7.5 out of 10.