CVE-2015-6432

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-01-05 · updated 2026-06-17
Weakness: CWE-399

Description

Cisco IOS XR 4.2.0, 4.3.0, 5.0.0, 5.1.0, 5.2.0, 5.2.2, 5.2.4, 5.3.0, and 5.3.2 does not properly restrict the number of Path Computation Elements (PCEs) for OSPF LSA opaque area updates, which allows remote attackers to cause a denial of service (device reload) via a crafted update, aka Bug ID CSCuw83486.

Affected products

Cisco IOS XR Software: 4.2.0, 4.3.0, 5.0.0, 5.1.0, 5.2.0, 5.2.2 (+3)

References

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160104-iosxr
http://www.securitytracker.com/id/1034570
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160104-iosxr
http://www.securitytracker.com/id/1034570

Get alerted when CVE-2015-6432 or the next vulnerability affects your stack