N/A

A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memory of an affected device. This vulnerability is due to improper management of memory resources during TLS connection setup. An attacker could exploit this vulnerability by repeatedly triggering the conditions that cause the memory increase. This could be done in a variety of ways, such as by repeatedly attempting Extensible Authentication Protocol (EAP) authentication when local EAP is enabled on an affected device or by using a machine-in-the-middle attack and resetting TLS connections between the affected device and other devices. A successful exploit could allow the attacker to exhaust the available memory on an affected device, resulting in an unexpected reload and a denial of service (DoS) condition.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

对活跃已分配资源丧失索引

Cisco IOS XE Software 安全漏洞

Cisco IOS XE Software是美国思科（Cisco）公司的一种网络操作系统。 Cisco IOS XE Software存在安全漏洞，该漏洞源于TLS连接建立期间内存资源管理不当，可能导致内存耗尽并引发拒绝服务。

N/A

N/A