CVE-2014-3396

Published: Oct 5, 2014Modified: May 6, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Cisco IOS XR on ASR 9000 devices does not properly use compression for port-range and address-range encoding, which allows remote attackers to bypass intended Typhoon line-card ACL restrictions via transit traffic, aka Bug ID CSCup30133.

Affected (8)

Products: Cisco: Ios Xr, Asr 9000 Rsp440 Router, Asr 9001, Asr 9006, Asr 9010, Asr 9904, Asr 9912, Asr 9922

Cisco

8 products

Ios Xr

Asr 9000 Rsp440 Router

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Cisco Ios Xr	All versions
Cisco Asr 9000 Rsp440 Router	All versions
Cisco Asr 9001	All versions
Cisco Asr 9006	All versions
Cisco Asr 9010	All versions
Cisco Asr 9904	All versions
Cisco Asr 9912	All versions
Cisco Asr 9922	All versions

Related CWEs

CWE-264

References (2)

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3396

Source: psirt@cisco.com

Vendor Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3396

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.