Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2014-3284: Cisco IOS XE on ASR1000 can reboot via bad PPPoE

CVE-2014-3284 · published 12 years ago

Summary

Cisco IOS XE software running on ASR1000 series routers can be forced to restart if it receives a specially crafted PPPoE packet while PPPoE termination is turned on. This unexpected reboot can interrupt network services and cause downtime. Install the latest Cisco software release that fixes the issue or disable PPPoE termination until the update can be applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cisco	ios_xe	All versions `cpe:2.3:o:cisco:ios_xe:-:::::::*`
cisco	asr_1001	All versions `cpe:2.3:h:cisco:asr_1001:-:::::::*`
cisco	asr_1002	All versions `cpe:2.3:h:cisco:asr_1002:-:::::::*`
cisco	asr_1002-x	All versions `cpe:2.3:h:cisco:asr_1002-x:-:::::::*`
cisco	asr_1002_fixed_router	All versions `cpe:2.3:h:cisco:asr_1002_fixed_router:-:::::::*`
cisco	asr_1004	All versions `cpe:2.3:h:cisco:asr_1004:-:::::::*`
cisco	asr_1006	All versions `cpe:2.3:h:cisco:asr_1006:-:::::::*`
cisco	asr_1013	All versions `cpe:2.3:h:cisco:asr_1013:-:::::::*`
cisco	asr_1023_router	All versions `cpe:2.3:h:cisco:asr_1023_router:-:::::::*`

Original advisory text

Cisco IOS XE on ASR1000 devices, when PPPoE termination is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed PPPoE packet, aka Bug ID CSCuo55180.

References

http://secunia.com/advisories/58405 Permissions Required
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3284 Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34346 Vendor Advisory
http://www.securityfocus.com/bid/67603 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1030283 Third Party Advisory VDB Entry

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published25 May 2014

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2014-3284 · NVD

Track software like this

Free during beta