Vulnerability Description
The Flex-VPN load-balancing feature in the ipsec-ikev2 implementation in Cisco IOS before 15.1(1)SY3 does not require authentication, which allows remote attackers to trigger the forwarding of VPN traffic to an attacker-controlled destination, or the discarding of this traffic, by arranging for an arbitrary device to become a cluster member, aka Bug ID CSCub93641.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ios | <= 15.1\(1\)sy2 |
Related Weaknesses (CWE)
References
- http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/releas
- http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/releas
FAQ
What is CVE-2012-5032?
CVE-2012-5032 is a vulnerability with a CVSS score of 6.4 (MEDIUM). The Flex-VPN load-balancing feature in the ipsec-ikev2 implementation in Cisco IOS before 15.1(1)SY3 does not require authentication, which allows remote attackers to trigger the forwarding of VPN tra...
How severe is CVE-2012-5032?
CVE-2012-5032 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-5032?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ios.