CVE-2016-6415
Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability
Description
CVE-2016-6415 is a high-severity information disclosure vulnerability in the IKEv1 implementation of multiple Cisco products, including IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0. A remote unauthenticated attacker can obtain sensitive information from device memory by sending a specially crafted IKEv1 Security Association (SA) negotiation request, known as the BENIGNCERTAIN attack. This vulnerability requires no authentication, no user interaction, and can be exploited with low complexity over the network. With an EPSS score of 93.0% placing it in the 99.8th percentile and its inclusion in CISA's Known Exploited Vulnerabilities catalog, CVE-2016-6415 represents one of the most actively targeted vulnerabilities in Cisco network infrastructure, capable of leaking cryptographic keys, configuration data, and other sensitive memory contents.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | ios | >= 12.2, <= 12.4; >= 15.0, <= 15.6 |
| cisco | ios xe | <= 3.18s |
| cisco | ios xr | >= 4.3.0, <= 4.3.4; >= 5.0.0, < 5.3.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1(Vendor Advisory)
- http://www.securityfocus.com/bid/93003(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1036841(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6415(US Government Resource)
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2016-6415 is classified under CWE-200, where the IKEv1 implementation in Cisco IOS, IOS XE, IOS XR, and PIX fails to properly handle Security Association negotiation requests, inadvertently exposing sensitive information from device memory to unauthenticated remote attackers. This weakness allows the disclosure of data that should remain confidential, including potential cryptographic material and internal device state information.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
Attack Vector (Network): CVE-2016-6415 is exploitable remotely over the network by sending crafted IKEv1 packets to affected Cisco devices, requiring no physical or adjacent network access. Attack Complexity (Low): exploitation is straightforward with no special conditions or preparation needed beyond sending a malicious SA negotiation request. Privileges Required (None): no authentication or credentials are required to exploit this vulnerability. User Interaction (None): the attack is fully automated and requires no action from any user or administrator. Confidentiality (High): successful exploitation exposes sensitive information from device memory, potentially including cryptographic keys, VPN credentials, configuration fragments, and other secrets. Integrity (None): the vulnerability does not allow modification of device data or configurations. Availability (None): exploitation does not impact device availability or cause denial of service. With a CVSS score of 7.5 (High) and an EPSS score of 93.0% indicating near-certain exploitation, CVE-2016-6415 poses a critical risk to any organization running affected Cisco infrastructure, as leaked memory contents can enable further attacks including VPN decryption and network compromise.
Exploit Maturity
Active exploitation is confirmed and widespread for CVE-2016-6415. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 9, 2023. The vulnerability is part of the BENIGNCERTAIN attack toolkit, which was publicly disclosed as part of the Shadow Brokers leak of alleged NSA exploits, making weaponized exploit code widely available. Cisco published advisory cisco-sa-20160916-ikev1 confirming the issue and its exploitation. The EPSS score of 93.0% at the 99.8th percentile reflects extremely high exploitation activity across the threat landscape. The availability of turnkey exploit tools combined with the network-wide impact of information disclosure from VPN infrastructure makes this one of the most dangerous vulnerabilities for organizations that have not yet patched their Cisco devices.
Remediation
- Apply Cisco security patches immediately: Update Cisco IOS to versions beyond the affected ranges (12.2-12.4 and 15.0-15.6), upgrade IOS XE past 3.18S, update IOS XR beyond 5.2.x, and migrate from PIX to a supported Cisco ASA platform. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA required remediation by June 9, 2023.
- Restrict IKEv1 access with ACLs: Implement access control lists to restrict IKEv1 (UDP port 500 and port 4500) traffic to only known and trusted VPN peers, preventing unauthorized hosts from sending malicious SA negotiation requests.
- Migrate to IKEv2: Transition VPN configurations from IKEv1 to IKEv2 where supported, as IKEv2 is not affected by the BENIGNCERTAIN attack and provides improved security features including stronger authentication mechanisms.
- Rotate cryptographic material: After patching, rotate all IKE pre-shared keys, VPN certificates, and other cryptographic credentials that may have been exposed through memory disclosure. Assume that any secrets present in device memory during the exploitation window have been compromised.
- Monitor for exploitation indicators: Review VPN logs and IKE negotiation records for anomalous SA negotiation patterns, particularly requests from unexpected source addresses. Deploy IDS/IPS signatures specific to the BENIGNCERTAIN exploit pattern to detect ongoing exploitation attempts.
Technical Details
CVE-2016-6415 is an information disclosure vulnerability (CWE-200) in the server-side IKEv1 (Internet Key Exchange version 1) implementation across Cisco IOS, IOS XE, IOS XR, and PIX platforms, internally tracked as Bug IDs CSCvb29204 and CSCvb36055. The flaw allows a remote unauthenticated attacker to extract sensitive contents from device memory by sending a specifically crafted IKEv1 SA negotiation request. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the attack is network-based with low complexity, requires no privileges or user interaction, and results in high confidentiality impact with no effect on integrity or availability. The scope is unchanged, meaning the information disclosure is confined to the targeted device. This vulnerability is associated with the BENIGNCERTAIN exploit tool disclosed by the Shadow Brokers group, which enables automated extraction of RSA private keys and other sensitive data from the memory of affected Cisco devices during IKEv1 negotiations. Affected products include Cisco IOS versions 12.2 through 12.4, 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX firewalls running versions prior to 7.0. The fix addresses improper memory handling during IKEv1 packet processing, ensuring that device memory contents are not leaked through crafted negotiation requests.
Frequently Asked Questions
Is CVE-2016-6415 being actively exploited?
Yes, CVE-2016-6415 is actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog, and weaponized exploit code has been publicly available since the Shadow Brokers disclosure as part of the BENIGNCERTAIN toolkit. The EPSS score of 93.0% at the 99.8th percentile confirms extremely high exploitation activity targeting Cisco VPN infrastructure.
What products are affected by CVE-2016-6415?
CVE-2016-6415 affects Cisco IOS versions 12.2 through 12.4 and 15.0 through 15.6, Cisco IOS XE through version 3.18S, Cisco IOS XR versions 4.3.x and 5.0.x through 5.2.x, and Cisco PIX firewalls running versions prior to 7.0. Any device running these versions with IKEv1 enabled is vulnerable.
How do I fix CVE-2016-6415?
Upgrade affected Cisco IOS, IOS XE, IOS XR, and PIX devices to patched versions as specified in Cisco advisory cisco-sa-20160916-ikev1. Restrict IKEv1 access to trusted peers using ACLs, migrate to IKEv2 where possible, and rotate all cryptographic credentials that may have been exposed through memory disclosure.
How severe is CVE-2016-6415?
CVE-2016-6415 has a CVSS score of 7.5 (High severity) with high confidentiality impact. The vulnerability allows unauthenticated remote extraction of sensitive device memory, potentially including cryptographic keys and VPN credentials. With an EPSS score of 93.0% and association with the BENIGNCERTAIN nation-state exploit tool, this vulnerability poses an extremely high risk to unpatched Cisco infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.