CVE-2006-4650

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-09-09 · updated 2026-06-16

Description

Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet during decapsulation, which leads to an integer overflow that references data from incorrect memory locations, which allows remote attackers to inject crafted packets into the routing queue, possibly bypassing intended router ACLs.

Affected products

Cisco IOS: 12.0, 12.1, 12.2

References

http://secunia.com/advisories/21783
http://securityreason.com/securityalert/1526
http://securitytracker.com/id?1016799
http://www.cisco.com/en/US/tech/tk827/tk369/tsd_technology_security_response09186a008072cd7b.html
http://www.osvdb.org/28590
http://www.phenoelit.de/stuff/CiscoGRE.txt
http://www.securityfocus.com/archive/1/445322/100/0/threaded
http://www.securityfocus.com/bid/19878
http://www.vupen.com/english/advisories/2006/3502
https://exchange.xforce.ibmcloud.com/vulnerabilities/28786
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5713
http://secunia.com/advisories/21783

Get alerted when CVE-2006-4650 or the next vulnerability affects your stack