CVE-2012-4623
HighSummary
Serwer DHCPv6 w systemach Cisco IOS w wersjach od 12.2 do 12.4 oraz od 15.0 do 15.2, a także w IOS XE w wersjach od 2.1.x do 2.6.x, 3.1.xS przed 3.1.4S, 3.1.xSG i 3.2.xSG przed 3.2.5SG, 3.2.xS, 3.2.xXO, 3.3.xS i 3.3.xSG przed 3.3.1SG, pozwala zdalnym atakującym na spowodowanie odmowy usługi (przeładowanie urządzenia) poprzez źle sformatowany pakiet DHCPv6.
Risk Assessment
Atakujący mogą wykorzystać tę podatność do zdalnego przeładowania urządzenia, co prowadzi do przerwy w dostępności usług sieciowych w organizacji.
Recommendation
Zaleca się aktualizację systemu IOS lub IOS XE do najnowszej wersji, aby usunąć tę podatność oraz monitorowanie ruchu DHCPv6 w celu wykrywania potencjalnych ataków.
Related vulnerabilities
- CVE-2026-124580Critical
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP version 1.0 B-MB3W202-210825-r11775, affecting the handle_wechat_cn_wifi function in var/html/webserver within the Weixin Auth Endpoint component. Manipulation of the extend argument results in OS command injection. The attack can be executed remotely and the exploit has been made public.
- CVE-2026-124577Critical
A weakness has been identified in Intelbras SG 2404 PoE L2+ versions 1.00.70 and 1.00.72, affecting an unknown function in the /EXCU_SHELL file within the Web Management Interface component. Manipulation can lead to improper authentication. The attack can be launched remotely and the exploit has been made publicly available.
- CVE-2026-113364Critical
Buffer overflow in the data receiving process in NEC WebSAM WinShare versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.
- CVE-2026-113363Critical
Improper input validation in the network communication processing in NEC WebSAM WinShare versions 7.2.0 through 7.5.0, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer running WinShare.
- CVE-2026-124560Critical
A vulnerability was found in D-Link DIR-878 version 1.20B05 in the GetCAPTCHAsetting function of bin/prog.cgi (HNAP Handler component). Manipulating the uid argument results in a heap-based buffer overflow. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-119506Critical
The Frontend Admin by DynamiApps plugin (acf-frontend-form-element) through version 3.30.1 contains an incorrect privilege assignment vulnerability. The flaw allows an attacker to escalate privileges within the WordPress site.
- CVE-2026-6715Critical
IBM Concert 1.0 through 3.0.1.1 allows an attacker to supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service.
- CVE-2026-17466Critical
IBM Optim versions 1.0.0, 1.1.0, and 1.2.0 are vulnerable to path traversal, allowing a remote authenticated attacker to obtain sensitive information.
- CVE-2026-15266Critical
IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.
- CVE-2026-114464Critical
IBM Process Mining 2.0.0 through 2.2.1 has improper access control, which could allow a remote attacker to obtain sensitive information.
Original NVD description (English source)
The DHCPv6 server in Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x, 3.1.xS before 3.1.4S, 3.1.xSG and 3.2.xSG before 3.2.5SG, 3.2.xS, 3.2.xXO, 3.3.xS, and 3.3.xSG before 3.3.1SG allows remote attackers to cause a denial of service (device reload) via a malformed DHCPv6 packet, aka Bug ID CSCto57723.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS