ZeroDay Findings
Sign inSign up

Findings

CVE-2016-6415

Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability

Published Sep 18, 2016 · updated Jun 16, 2026 · cisco ios

Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 18, 2016 · Catalog

    Detected

    Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory co

  2. May 19, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 9, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory co

Required action

Apply updates per vendor instructions.

CISA due date Jun 9, 2023

Affected

  • cpe cisco/iosversion unspecified
  • cpe cisco/ios xeversion unspecified
  • cpe cisco/ios xrversion unspecified
  • vendor Cisco IOS, IOS XR, and IOS XEversion unspecified

Sources

  • CISA KEVCVE-2016-6415

    Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory co

    cisa.gov
  • CVE.orgCVE-2016-6415

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2016-6415

    30-day exploitation probability 87.7%

    first.org
  • Exploit Database43383

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesauxiliary_scanner/ike/cisco_ike_benigncertain

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2016-6415

    The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiat

    nvd.nist.gov

References