Vulnerabilities/CVE-2015-0606

CVE-2015-0606: cisco ios Improper Input Validation

SSVC · Estimated by CveMateTrackHandle in routine patching. CISA has no entry yet, so CveMate computed this from CVSS and exploit data. It is replaced when CISA publishes.

ExploitationNone (derived)

AutomatableNo (derived)

Technical impactPartial (derived)

Mission & well-beingHigh (assumed)

Source: CveMate estimate, same decision tree as CISA.CISA publishes the first three inputs. Mission & well-being depends on your environment, so it is assumed at its highest: the decision is a worst case.

Modified

Published 12-02-2015Last modified 06-08-2024

On this page

Summary Timeline Description CVSS metrics EPSS trend Known exploited Public exploits Weaknesses Affected systems References

Key information

Published12-02-2015

Modified06-08-2024

SourceNVD

CVSS4.9

EPSS0.34%

KEV0

Exploits0

Vulnerability summary

CVE-2015-0606 is a medium (CVSS 4.9) Improper Input Validation vulnerability in cisco ios. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.2% of scored vulnerabilities.

Overall risk

20/100

0100

Low · default modelHow is this calculated?

SSVC · Estimated by CveMateTrackHandle in routine patching. CISA has no entry yet, so CveMate computed this from CVSS and exploit data. It is replaced when CISA publishes.

ExploitationNone (derived)

AutomatableNo (derived)

Technical impactPartial (derived)

Mission & well-beingHigh (assumed)

CVSS score

4.9/10

010

Medium · v2.0 (NVD)

EPSS score

0.34%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

12-02-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The IOS Shell in Cisco IOS allows local users to cause a denial of service (device crash) via unspecified commands, aka Bug ID CSCur59696.

CVSS metrics

1 score · 1 source · 1 version

v2.04.9

Medium 4.9Preferred score · NVD (NIST)

AV:L/AC:L/Au:N/C:N/I:N/A:C

SourcesSingle source

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

26%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.34% on 22-09-2026

100%75%50%25%0%

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Cisco1 product

iosna

1 vendor · 1 product

References

4 links

tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0606Vendor AdvisoryX Refsource CISCO
www.securityfocus.com/bid/72550VDB EntryX Refsource BID
www.securitytracker.com/id/1031717VDB EntryX Refsource SECTRACK
exchange.xforce.ibmcloud.com/vulnerabilities/100810VDB EntryX Refsource XF

Related vulnerabilities

All vulnerabilities inios