CVE-2016-1344: Cisco IOS XE

Medium severity, CVSS 5.9. EPSS: 3% chance of exploitation in the next 30 days.

The IKEv2 implementation in Cisco IOS 15.0 through 15.6 and IOS XE 3.3 through 3.17 allows remote attackers to cause a denial of service (device reload) via fragmented packets, aka Bug ID CSCux38417.

Affected products

• Cisco IOS XE: version 3.3s_3.3.0s only; version 3.3s_3.3.1s only; version 3.3s_3.3.2s only; version 3.3sg_3.3.0sg only; version 3.3sg_3.3.1sg only; version 3.3sg_3.3.2sg only; …
• Lenovo Thinkcentre e75s Firmware: before m16kt61a (fixed in m16kt61a)
• NETGEAR JR6150 Firmware: before 2017-01-06 (fixed in 2017-01-06)
• Samsung x14j Firmware: version t-ms14jakucb-1102.5 only
• Sun Opensolaris: version snv_124 only
• Zyxel GS1900-10hp Firmware: before 2.50\(aazi.0\)c0 (fixed in 2.50\(aazi.0\)c0)
• Zzinc Keymouse Firmware: version 3.08 only

Published 2016-03-26. Last modified 2026-06-17.