CVE-2009-0635: Cisco IOS

High severity, CVSS 7.1. EPSS: 2.5% chance of exploitation in the next 30 days.

Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets.

Affected products

• Cisco IOS: version 12.4t only; version 12.4xz only; version 12.4ya only

Published 2009-03-27. Last modified 2026-06-16.