What’s Vulnerable › Vulnerabilities

CVE-2001-0895

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2001-11-15 · updated 2026-06-16

Description

Multiple Cisco networking products allow remote attackers to cause a denial of service on the local network via a series of ARP packets sent to the router's interface that contains a different MAC address for the router, which eventually causes the router to overwrite the MAC address in its ARP table.

Affected products

• Cisco Catalyst 2900Xl: all versions
• Cisco Catalyst 2948G-L3: all versions
• Cisco Catalyst 2950: all versions
• Cisco Catalyst 3500Xl: all versions
• Cisco Catalyst 3550: all versions
• Cisco Catalyst 4000: all versions
• Cisco Catalyst 4908G-L3: all versions
• Cisco Catalyst 5000: all versions
• Cisco Catalyst 6000: all versions
• Cisco Catalyst 8500: all versions
• Cisco Distributed Director: all versions

References

• http://www.cisco.com/warp/public/707/IOS-arp-overwrite-vuln-pub.shtml
• http://www.kb.cert.org/vuls/id/399355
• http://www.osvdb.org/807
• http://www.securityfocus.com/bid/3547
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7547
• http://www.cisco.com/warp/public/707/IOS-arp-overwrite-vuln-pub.shtml
• http://www.kb.cert.org/vuls/id/399355
• http://www.osvdb.org/807
• http://www.securityfocus.com/bid/3547
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7547

Get alerted when CVE-2001-0895 or the next vulnerability affects your stack