CVE-2014-2146

6.5 mediumEPSS 1.3%

The Zone-Based Firewall (ZBFW) functionality in Cisco IOS, possibly 15.4 and earlier, and IOS XE, possibly 3.13 and earlier, mishandles zone checking for existing sessions, which allows remote attackers to bypass intended resource-access restrictions via spoofed traffic that matches one of these sessions, aka Bug IDs CSCun94946 and CSCun96847.

Severity

CVSS 3.0

6.5 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2016-09-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cisco:ios
cisco:ios_xe

References

http://www.securityfocus.com/bid/93126
https://tools.cisco.com/security/center/viewAlert.x?alertId=39129
http://www.securityfocus.com/bid/93126
https://tools.cisco.com/security/center/viewAlert.x?alertId=39129

Check your stack JSON