‹ Volver al listado

CVE-2006-4650

Estado: ModificadaBaja (2.6)—
Gravedad2.6Baja · CVSS 2.0
Probabilidad de explotación3.23 %mayor que el 88 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado

Cisco IOS 12.0, 12.1, y 12.2, cuando la tunelación GRE IP esta siendo usada y falta la conformidad RFC2784, no verifica el campo offset de un paquete GRE durante su encapsulación, lo cauls lleva a un desbordamiento de enteros que referencia datos desde localizaciones de memoria incorrectas, lo cual permite a un atacante remoto inyectar paquetes artesanales dentro de la cola de enrutamiento, posiblemente evitando la ACLs del router previsto.

CVSS

Puntuación base
2.6
Versión
2.0
Vector
AV:N/AC:H/Au:N/C:P/I:N/A:N

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días
3.23 %
Percentil entre todas las CVEs puntuadas
88
Fecha de la puntuación
22/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — IOS

CWE

Referencias

Mostrar las 22 referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-4650",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-09-09T00:04:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/21783",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/1526",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1016799",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.cisco.com/en/US/tech/tk827/tk369/tsd_technology_security_response09186a008072cd7b.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/28590",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.phenoelit.de/stuff/CiscoGRE.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/445322/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/19878",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/3502",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28786",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5713",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/21783",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/1526",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1016799",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.cisco.com/en/US/tech/tk827/tk369/tsd_technology_security_response09186a008072cd7b.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/28590",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.phenoelit.de/stuff/CiscoGRE.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/445322/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/19878",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/3502",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28786",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5713",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet during decapsulation, which leads to an integer overflow that references data from incorrect memory locations, which allows remote attackers to inject crafted packets into the routing queue, possibly bypassing intended router ACLs."
    },
    {
      "lang": "es",
      "value": "Cisco IOS 12.0, 12.1, y 12.2, cuando la tunelación GRE IP esta siendo usada y falta la conformidad RFC2784, no verifica el campo offset de un paquete GRE durante su encapsulación, lo cauls lleva a un desbordamiento de enteros que referencia datos desde localizaciones de memoria incorrectas, lo cual permite a un atacante remoto inyectar paquetes artesanales dentro de la cola de enrutamiento, posiblemente evitando la ACLs del router previsto."
    }
  ],
  "lastModified": "2026-06-16T22:29:31.427",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ios:12.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F86F790-6247-42F2-9487-3D60A2842F52"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios:12.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F2F9EC5-EDA2-4C99-BBF1-2F2C92AACE95"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios:12.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4BC49F2-3DCB-45F0-9030-13F6415EE178"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}