CVE-2013-0149

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-08-05 · updated 2026-06-16

Description

The OSPF implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.3, IOS-XE 2.x through 3.9.xS, ASA and PIX 7.x through 9.1, FWSM, NX-OS, and StarOS before 14.0.50488 does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a (1) unicast or (2) multicast packet, aka Bug IDs CSCug34485, CSCug34469, CSCug39762, CSCug63304, and CSCug39795.

Affected products

Cisco Asa 5500: 7.0, 7.1, 7.2, 8.0, 8.1, 8.2 (+2)
Cisco Fwsm: all versions
Cisco IOS: 12.0, 12.0(1), 12.0(1)s, 12.0(1)st, 12.0(1)w, 12.0(1)xa3 (+481)
Cisco IOS XE: 2.1.0, 2.1.1, 2.1.2, 2.2.1, 2.2.2, 2.2.3 (+56)
Cisco NX-OS: all versions
Cisco Pix Firewall Software: 7.0, 7.1, 7.2, 8.0(2), 9.0, 9.1
Cisco StarOS: 14.0

References

Get alerted when CVE-2013-0149 or the next vulnerability affects your stack