CVE-2016-6415 kev in the critical feed json
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through…
published 2016-09-19 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-7338
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Exploited
- added 2023-05-19
- epss
- 87.7%
- EPSS 87.7% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 2
- Metasploit, Exploit-DB
Summary
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.
Patch / fix
cisa required action Apply updates per vendor instructions.
- cisco ios_xr 5.3.0
Timeline
- Published
- First public exploit (Metasploit auxiliary/scanner/ike/cisco_ike_benigncertain)
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 3 y ago
- Patch by
- 2023-06-09 (3 y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Cisco, IOS, IOS XR, and IOS XE
- CISA name
- Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
87.69% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit auxiliary/scanner/ike/cisco_ike_benigncertain Cisco IKE Information Disclosure metasploit auxiliary, normal rank, 2016-09-29
- EDB-43383 Cisco IOS 12.2 < 12.4 / 15.0 < 15.6 - Security Association Negotiation Request Device Memory remote, 2017-03-17
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- Technology feeds
References
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1
vendor-advisory
-
securitytracker.com
/id/1036841
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/93003
vdb-entry, third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6415
government-resource, us-government-resource
Sources
- CVE List CVE-2016-6415
- NVD CVE-2016-6415
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.