CVE-2014-3396: Cisco Asr 9000 RSP440 Router

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

Cisco IOS XR on ASR 9000 devices does not properly use compression for port-range and address-range encoding, which allows remote attackers to bypass intended Typhoon line-card ACL restrictions via transit traffic, aka Bug ID CSCup30133.

Affected products

• Cisco Asr 9000 RSP440 Router
• Cisco Asr 9001
• Cisco Asr 9006
• Cisco Asr 9010
• Cisco Asr 9904
• Cisco Asr 9912
• Cisco Asr 9922
• Cisco IOS XR: any version

Published 2014-10-05. Last modified 2026-06-17.