Vulnerability Name:

CVE-2015-6365 (CCN-108015)

Assigned:2015-11-13
Published:2015-11-13
Updated:2016-12-07
Summary:Cisco IOS 15.2(04)M and 15.4(03)M lets physical-interface ACLs supersede virtual PPP interface ACLs, which allows remote authenticated users to bypass intended network-traffic restrictions in opportunistic circumstances by using PPP, aka Bug ID CSCur61303.
CVSS v3 Severity:4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-20
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2015-6365

Source: CCN
Type: Cisco Security Advisory cisco-sa-20151112-ios1
Cisco IOS Software Virtual PPP Interfaces Security Bypass Vulnerability

Source: CISCO
Type: Vendor Advisory
20151113 Cisco IOS Software Virtual PPP Interfaces Security Bypass Vulnerability

Source: SECTRACK
Type: UNKNOWN
1034158

Source: XF
Type: UNKNOWN
ciscoios-cve20156365-sec-bypass(108015)

Vulnerable Configuration:Configuration 1:
  • cpe:/o:cisco:ios:15.2(4)m:*:*:*:*:*:*:*
  • OR cpe:/o:cisco:ios:15.4(3)m:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    cisco ios 15.2(4)m
    cisco ios 15.4(3)m