Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2001-0867: Cisco 12000 Router lets attackers bypass fragment filter
CVE-2001-0867 · published 24 years ago
Summary
The Cisco 12000 router running IOS 12.0 and Engine 2 line cards does not correctly block split network packets, even when the ACL includes the "fragment" rule. This means an attacker could send fragmented traffic to get past the intended access controls. Update the router software or apply the vendor's recommended configuration changes to ensure proper packet filtering.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cisco | 12000_router |
All versions
cpe:2.3:h:cisco:12000_router:*:*:*:*:*:*:*:* |
Original advisory text
Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly filter does not properly filter packet fragments even when the "fragment" keyword is used in an ACL, which allows remote...
Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly filter does not properly filter packet fragments even when the "fragment" keyword is used in an ACL, which allows remote attackers to bypass the intended access controls.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Timeline
Published6 Dec 2001
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2001-0867 · NVD
Track software like this
Free during beta