Vulnerability Details : CVE-2015-0610
Race condition in the object-group ACL feature in Cisco IOS 15.5(2)T and earlier allows remote attackers to bypass intended access restrictions via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching, aka Bug ID CSCun21071.
Products affected by CVE-2015-0610
- cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios:15.5\(1\)t:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios:15.5t:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios:15.5\(1\)t1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-0610
0.42%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 74 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-0610
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2015-0610
-
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-0610
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/100807
Cisco IOS ACL security bypass CVE-2015-0610 Vulnerability Report
-
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0610
Cisco SecurityVendor Advisory
-
http://www.securityfocus.com/bid/72565
Cisco IOS CVE-2015-0610 Security Bypass Vulnerability
-
http://tools.cisco.com/security/center/viewAlert.x?alertId=37423
Cisco SecurityVendor Advisory
-
http://www.securitytracker.com/id/1031732
Cisco IOS Race Condition Lets Remote Users Bypass Access Controls - SecurityTracker
Jump to