CVE-2004-1464
Cisco IOS Denial-of-Service Vulnerability
Description
CVE-2004-1464 is a medium-severity denial of service vulnerability in Cisco IOS 12.2(15) and earlier versions that allows remote attackers to refuse VTY (virtual terminal) connections by sending crafted TCP connections to the Telnet or reverse Telnet port. This vulnerability exploits an uncontrolled resource consumption weakness in the IOS Telnet implementation, causing the device to exhaust available VTY lines and preventing administrators from establishing new remote management sessions. The attack requires no authentication or user interaction, though the attack complexity is high as specific network conditions must be met. With an EPSS score of 1.7% placing it in the 82nd percentile and its inclusion in CISA's Known Exploited Vulnerabilities catalog, CVE-2004-1464 represents a confirmed threat to network infrastructure devices running affected Cisco IOS versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | ios | <= 12.2\(15\)zj3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- http://secunia.com/advisories/12395/(Broken Link, Vendor Advisory)
- http://securitytracker.com/id?1011079(Broken Link, Third Party Advisory, VDB Entry)
- http://www.cisco.com/warp/public/707/cisco-sa-20040827-telnet.shtml(Not Applicable, Vendor Advisory)
- http://www.kb.cert.org/vuls/id/384230(Patch, Third Party Advisory, US Government Resource)
- http://www.securityfocus.com/bid/11060(Broken Link, Third Party Advisory, VDB Entry)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17131(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2004-1464(US Government Resource)
Weakness Type
CWE-400: Uncontrolled Resource Consumption
CVE-2004-1464 is classified under CWE-400 (Uncontrolled Resource Consumption), where the Cisco IOS Telnet service fails to properly manage VTY line resources when processing crafted TCP connections. This weakness allows an attacker to exhaust the finite pool of virtual terminal lines, effectively locking out legitimate administrators from remote device management. The lack of adequate resource throttling or connection validation enables sustained denial of service conditions.
Learn more: CWE-400 — Uncontrolled Resource Consumption
Impact Analysis
Attack Vector (Network): CVE-2004-1464 is exploitable remotely over the network by sending crafted TCP connections to the Telnet or reverse Telnet port of affected Cisco IOS devices, requiring no physical or local access. Attack Complexity (High): exploitation requires specific conditions to be met, such as timing or particular network configurations, which limits the ease of mass exploitation. Privileges Required (None): no authentication credentials are needed to initiate the attack. User Interaction (None): the attack can be carried out without any action from a user or administrator on the target device. Confidentiality (None): this vulnerability does not expose any sensitive data from the device. Integrity (None): the vulnerability does not allow modification of device configurations or data. Availability (High): successful exploitation results in complete denial of VTY access, preventing remote management of the network device. With a CVSS score of 5.9 (Medium) and confirmed exploitation in the wild, CVE-2004-1464 poses a significant operational risk to organizations relying on Telnet-based management of Cisco IOS infrastructure, as it can lock administrators out of critical network equipment during an attack.
Exploit Maturity
Active exploitation has been confirmed for CVE-2004-1464, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a required remediation date of June 9, 2023. The vulnerability has been publicly known since 2004 with advisory details available from Cisco (cisco-sa-20040827-telnet), CERT/CC (VU#384230), and multiple security tracking databases. The EPSS score of 1.7% at the 82nd percentile indicates moderate but ongoing exploitation probability. While the attack complexity is high, the long public exposure of this vulnerability and availability of detailed technical information increase the likelihood that threat actors targeting legacy network infrastructure would leverage this flaw. Organizations still running Cisco IOS 12.2(15) or earlier versions should treat this as an actively exploited vulnerability requiring immediate attention.
Remediation
- Upgrade Cisco IOS to a patched version: Update Cisco IOS beyond version 12.2(15) to a release that addresses the VTY denial of service condition. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA required remediation by June 9, 2023.
- Implement access control lists (ACLs) on VTY lines: Configure ACLs to restrict Telnet and SSH access to VTY lines from trusted management IP addresses only, reducing the attack surface for unauthorized connection attempts.
- Disable Telnet and migrate to SSH: Disable Telnet services on all Cisco IOS devices and transition to SSH for encrypted remote management, which provides stronger authentication and is less susceptible to connection-based denial of service attacks.
- Configure VTY line timeouts and limits: Set appropriate session timeouts and connection limits on VTY lines to automatically reclaim resources from idle or suspicious sessions, reducing the effectiveness of resource exhaustion attacks.
- Deploy network monitoring and alerting: Monitor VTY line utilization and Telnet connection patterns using SNMP or syslog alerts. Detect anomalous connection attempts that may indicate exploitation of this vulnerability and trigger automated response procedures.
Technical Details
CVE-2004-1464 is an uncontrolled resource consumption vulnerability (CWE-400) in the Telnet implementation of Cisco IOS version 12.2(15) and earlier. The flaw resides in how the IOS handles incoming TCP connections to the Telnet (port 23) and reverse Telnet ports, where crafted TCP connection attempts can consume available VTY (Virtual Terminal) lines without establishing legitimate sessions. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates that while the attack is network-based and requires no authentication, the high attack complexity means specific conditions must exist for successful exploitation. The scope is unchanged, confining the impact to the targeted device itself. When all VTY lines are consumed by the crafted connections, the device refuses additional management sessions, effectively denying administrators remote access to the router or switch. Cisco documented this issue in advisory cisco-sa-20040827-telnet, and CERT/CC tracked it as VU#384230. The fix involves upgrading to a Cisco IOS version that properly validates and manages TCP connections to VTY services, implementing connection rate limiting and resource reclamation for incomplete or malicious sessions.
Frequently Asked Questions
Is CVE-2004-1464 being actively exploited?
Yes, CVE-2004-1464 has confirmed active exploitation. CISA has added it to the Known Exploited Vulnerabilities catalog, requiring federal agencies to remediate by June 9, 2023. The vulnerability has been publicly known since 2004, and its long exposure combined with an EPSS score of 1.7% (82nd percentile) indicates ongoing exploitation risk against legacy Cisco infrastructure.
What products are affected by CVE-2004-1464?
CVE-2004-1464 affects Cisco IOS version 12.2(15) and all earlier versions. Any Cisco router or switch running these legacy IOS releases with Telnet or reverse Telnet services enabled is vulnerable to this denial of service attack targeting VTY line exhaustion.
How do I fix CVE-2004-1464?
Upgrade Cisco IOS to a version newer than 12.2(15) that addresses the Telnet VTY denial of service issue. Additionally, implement VTY access control lists to restrict remote management access, disable Telnet in favor of SSH, and configure appropriate session timeouts on VTY lines.
How severe is CVE-2004-1464?
CVE-2004-1464 has a CVSS score of 5.9 (Medium severity) with high impact on availability. While it does not compromise confidentiality or integrity, the denial of remote management access to critical network infrastructure devices can have severe operational consequences, particularly in environments relying on Telnet-based device management.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.