CVE Feed

    Dashboard / CVE / CVE-2014-3396

    CVE-2014-3396

    Cisco IOS XR on ASR 9000 devices does not properly use compression for port-range and address-range encoding, which allows remote attackers to bypass intended Typhoon line-card ACL restrictions via transit traffic, aka Bug ID CSCup30133.

    Published:Oct 5, 2014
    Last Modified:Apr 12, 2025
    EPS:Oct 5, 2014
    EPSS Score:0.00225
    CVSS Score:7.5

    Affected Products

    Vendor
    Cisco
    Product
    Asr 9000 Rsp440 Router
    Vendor
    Cisco
    Product
    Asr 9001
    Vendor
    Cisco
    Product
    Asr 9006
    Vendor
    Cisco
    Product
    Asr 9010
    Vendor
    Cisco
    Product
    Asr 9904
    Vendor
    Cisco
    Product
    Asr 9912
    Vendor
    Cisco
    Product
    Asr 9922
    Vendor
    Cisco
    Product
    Ios Xr

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2022-20919 (CVSS 8.6) — A vulnerability in the processing of malformed Common Industrial Protocol (CIP) packets that are sent to Cisco…
    CVE-2014-3335 (CVSS 4.6) — Cisco IOS XR 4.3(.2) and earlier on ASR 9000 devices does not properly perform NetFlow sampling of packets wit…
    CVE-2014-3322 (CVSS 6.1) — Cisco IOS XR 4.3(.2) and earlier on ASR 9000 devices does not properly perform NetFlow sampling of IP packets,…
    CVE-2014-3321 (CVSS 5.7) — Cisco IOS XR 4.3.4 and earlier on ASR 9000 devices, when bridge-group virtual interface (BVI) routing is enabl…
    CVE-2014-3308 (CVSS 6.4) — Cisco IOS XR on Trident line cards in ASR 9000 devices lacks a static punt policer, which allows remote attack…
    CVE-2012-1366 (CVSS 6.1) — Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled fo…
    CVE-2012-2488 (CVSS 7.8) — Cisco IOS XR before 4.2.1 on ASR 9000 series devices and CRS series devices allows remote attackers to cause a…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High