CVE-2006-3906: Cisco Adaptive Security Appliance Software

Medium severity, CVSS 5.0. EPSS: 6.9% chance of exploitation in the next 30 days.

Internet Key Exchange (IKE) version 1 protocol, as implemented on Cisco IOS, VPN 3000 Concentrators, and PIX firewalls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of IKE Phase-1 packets that exceed the session expiration rate. NOTE: it has been argued that this is due to a design weakness of the IKE version 1 protocol, in which case other vendors and implementations would also be affected.

Affected products

Cisco Adaptive Security Appliance Software: version 7.0 only; version 7.0(4) only; version 7.0(5) only; version 7.0.1.4 only; version 7.0.4.3 only; version 7.1(2) only
Cisco IOS: any version
Cisco Pix ASA Ids: any version
Cisco Pix Firewall: version 6.2.2_.111 only; version 6.2.3_(110) only; version 6.3.3_(133) only; version 6.3.5_(112) only
Cisco Pix Firewall 501: any version
Cisco Pix Firewall 506: any version
Cisco Pix Firewall 515: any version
Cisco Pix Firewall 515e: any version
Cisco Pix Firewall 520: any version
Cisco Pix Firewall 525: any version
Cisco Pix Firewall 535: any version
Cisco Pix Firewall Software: version 2.7 only; version 3.0 only; version 3.1 only; version 4.0 only; version 4.1(6) only; version 4.1(6b) only; …
Cisco Secure Pix Firewall: any version
Cisco VPN 3000 Concentrator Series Software: version 2.0 only; version 2.5.2.a only; version 2.5.2.b only; version 2.5.2.c only; version 2.5.2.d only; version 2.5.2.f only; …
Cisco VPN 3001 Concentrator: any version
Cisco VPN 3005 Concentrator Software: version 4.0.1 only
Cisco VPN 3015 Concentrator: any version
Cisco VPN 3020 Concentrator: any version
Cisco VPN 3030 Concentator: any version; version 4.7(rel) only; version 4.7.1 only; version 4.7.1.f only; version 4.7.2 only; version 4.7.2.a only; …
Cisco VPN 3060 Concentrator: any version
Cisco VPN 3080 Concentrator: any version

Published 2006-07-27. Last modified 2026-06-16.