CVEs / CVE-2004-1464
CVE-2004-1464: Cisco IOS Denial-of-Service Vulnerability
- Known exploited in the CISA KEV catalog since 19 May 2023
- medium 5.9 CVSS 3.1 (NVD)
- EPSS 4.84% chance of exploitation in the next 30 days, higher than 91% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2004-1464
Summary
Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device.
Description
Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or reverse Telnet port.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | n/a | — |
Exploitation
| In CISA KEV since | 19 May 2023 |
|---|---|
| Due date for US federal agencies | 9 Jun 2023 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 3.1 | 5.9 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HScored by NVD |
|---|---|
| Weakness | CWE-400 |
References
- CVE-2004-1464 on NVD
- CVE-2004-1464 in the CISA KEV catalog
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040827-telnet (cited by CISA)
- http://secunia.com/advisories/12395/ Broken Link, Vendor Advisory
- http://securitytracker.com/id?1011079 Broken Link, Third Party Advisory, VDB Entry
- http://www.cisco.com/warp/public/707/cisco-sa-20040827-telnet.shtml Not Applicable, Vendor Advisory
- http://www.kb.cert.org/vuls/id/384230 Patch, Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/11060 Broken Link, Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17131 Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2004-1464 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.