CVE-2016-1409: Cisco IOS

High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days.

The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS XE 2.1 through 3.17S, IOS XR 2.0.0 through 5.3.2, and NX-OS allows remote attackers to cause a denial of service (packet-processing outage) via crafted ND messages, aka Bug ID CSCuz66542, as exploited in the wild in May 2016.

Affected products

• Cisco IOS: version 12.0(1) only; version 12.0(1)db only; version 12.0(1)s only; version 12.0(1)t only; version 12.0(1)t1 only; version 12.0(1)xa only; …
• Cisco IOS XE: version 2.1.0 only; version 2.1.1 only; version 2.1.2 only; version 2.1.3 only; version 2.2.0 only; version 2.2.1 only; …
• Cisco IOS XR: version 2.0.0 only; version 3.0.0 only; version 3.0.1 only; version 3.2.0 only; version 3.2.1 only; version 3.2.2 only; …
• Cisco NX-OS: version 1.0(1.110a) only; version 1.0(1e) only; version 1.0(2j) only; version 1.1(0.825a) only; version 1.1(1g) only; version 4.0(0)n1(1a) only; …

Published 2016-05-29. Last modified 2026-06-17.