A vulnerability in the Cisco TrustSec (CTS) Protected Access Credential (PAC) provisioning module of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition.
The vulnerability is due to improper validation of attributes in RADIUS messages. An attacker could exploit this vulnerability by sending a malicious RADIUS message to an affected device while the device is in a specific state.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ctspac-dos [“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ctspac-dos”]
Vendor | Product | Version | CPE |
---|---|---|---|
cisco | cisco_ios_xe_software | 16.3 | cpe:2.3:a:cisco:cisco_ios_xe_software:16.3:*:*:*:*:*:*:* |
cisco | cisco_ios_xe_software | 16.4 | cpe:2.3:a:cisco:cisco_ios_xe_software:16.4:*:*:*:*:*:*:* |
cisco | cisco_ios_xe_software | 16.5 | cpe:2.3:a:cisco:cisco_ios_xe_software:16.5:*:*:*:*:*:*:* |
cisco | cisco_ios_xe_software | 3.18sp | cpe:2.3:a:cisco:cisco_ios_xe_software:3.18sp:*:*:*:*:*:*:* |
cisco | cisco_ios_xe_software | 16.6 | cpe:2.3:a:cisco:cisco_ios_xe_software:16.6:*:*:*:*:*:*:* |
cisco | cisco_ios_xe_software | 16.7 | cpe:2.3:a:cisco:cisco_ios_xe_software:16.7:*:*:*:*:*:*:* |
cisco | cisco_ios_xe_software | 16.8 | cpe:2.3:a:cisco:cisco_ios_xe_software:16.8:*:*:*:*:*:*:* |
cisco | cisco_ios_xe_software | 16.9 | cpe:2.3:a:cisco:cisco_ios_xe_software:16.9:*:*:*:*:*:*:* |
cisco | cisco_ios_xe_software | 16.10 | cpe:2.3:a:cisco:cisco_ios_xe_software:16.10:*:*:*:*:*:*:* |
cisco | cisco_ios_xe_software | 16.11 | cpe:2.3:a:cisco:cisco_ios_xe_software:16.11:*:*:*:*:*:*:* |