Critical severity · published Nov 3, 2016
CVE-2016-6441
A vulnerability in the Transaction Language 1 (TL1) code of Cisco ASR 900 Series routers could allow an unauthenticated, remote attacker to cause a reload of, or remotely execute…
9.8
CVSS
4.9%
EPSS
No
On KEV
Description
A vulnerability in the Transaction Language 1 (TL1) code of Cisco ASR 900 Series routers could allow an unauthenticated, remote attacker to cause a reload of, or remotely execute code on, the affected system. This vulnerability affects Cisco ASR 900 Series Aggregation Services Routers (ASR902, ASR903, and ASR907) that are running the following releases of Cisco IOS XE Software: 3.17.0S 3.17.1S 3.17.2S 3.18.0S 3.18.1S. More Information: CSCuy15175. Known Affected Releases: 15.6(1)S 15.6(2)S. Known Fixed Releases: 15.6(1)S2.12 15.6(1.17)S0.41 15.6(1.17)SP 15.6(2)SP 16.4(0.183) 16.5(0.10).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.9% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IX
IOS XE · Cisco
3.17.0s; 3.17.1s; 3.17.2s; 3.17s; 3.18.0s; 3.18.1s; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6441
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6441
www.securityfocus.com
http://www.securityfocus.com/bid/94072
www.securitytracker.com
http://www.securitytracker.com/id/1037179
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161102-tl1
More from IOS XE
10.0
CVE-2023-20198
Cisco IOS XE Web UI Privilege Escalation Vulnerability
9.8
CVE-2018-0151
Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability
9.8
CVE-2017-3881
Cisco IOS and IOS XE Remote Code Execution Vulnerability
8.8
CVE-2018-0167
Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
8.8
CVE-2017-6738
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability