CoreCVE
Back

MEDIUM

The Flex-VPN load-balancing feature in the ipsec-ikev2 implementation in Cisco IOS before 15.1(1)SY3 does not require authentication, which allows remote attackers to trigger the forwarding of VPN traffic to an attacker-controlled destination, or the discarding of this traffic, by arranging for an arbitrary device to become a cluster member, aka Bug ID CSCub93641

Published Apr 23, 2014

Description

The Flex-VPN load-balancing feature in the ipsec-ikev2 implementation in Cisco IOS before 15.1(1)SY3 does not require authentication, which allows remote attackers to trigger the forwarding of VPN traffic to an attacker-controlled destination, or the discarding of this traffic, by arranging for an arbitrary device to become a cluster member, aka Bug ID CSCub93641.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-287

Improper Authentication

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner cisco
Published Apr 23, 2014
Updated Aug 6, 2024
Reserved Sep 21, 2012
Link CVE-2012-5032
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 16, 2026
Link CVE-2012-5032
Red Hat
Severity n/a
Public date n/a
Links CVE-2012-5032