CVE-2016-6399

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-09-12 · updated 2026-06-17
Weakness: CWE-20

Description

Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause a denial of service (device reload) via crafted (1) SSL or (2) TLS packets, aka Bug ID CSCvb16317.

Affected products

Cisco Ace 4700 Series Application Control Engine Appliance: a5(1.0), a5(1.1), a5(1.2), a5(2.0), a5(2.1), a5(2.1e) (+2)
Cisco Ace 4700 Series Application Control Engine Appliance A1: 7, 7a, 7b, 8.0, 8.0a
Cisco Ace 4700 Series Application Control Engine Appliance A3: 1.0, 2.0, 2.2, 2.3, 2.4, 2.5 (+2)
Cisco Ace 4700 Series Application Control Engine Appliance A4: 1.0, 1.1, 2.0, 2.1a, 2.2, 2.3
Cisco Ace 4700 Series Application Control Engine Appliance A5: 3.1a, 3.1b, 3.2, 3.3
Cisco Ace Application Control Engine Module A1: 7a, 7b, 8.0, 8.0a
Cisco Ace Application Control Engine Module A3: 1.0, 2.0, 2.2, 2.3, 2.4, 2.5 (+2)
Cisco Ace Application Control Engine Module A4: 1.0, 1.1, 2.0, 2.1a, 2.2, 2.3
Cisco Ace Application Control Engine Module A5: 1.0, 1.1, 1.2, 2.0, 2.1, 2.1e (+5)

References

Get alerted when CVE-2016-6399 or the next vulnerability affects your stack