CVE-2016-6380: Cisco IOS

High severity, CVSS 8.1. EPSS: 3% chance of exploitation in the next 30 days.

The DNS forwarder in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.15 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (data corruption or device reload) via a crafted DNS response, aka Bug ID CSCup90532.

Affected products

• Cisco IOS: version 12.0(3)t only; version 12.0(3)t1 only; version 12.0(3)t2 only; version 12.0(3)t3 only; version 12.0(3)xe only; version 12.0(3)xe1 only; …
• Cisco IOS XE: version 3.1.0s only; version 3.1.0sg only; version 3.1.1s only; version 3.1.1sg only; version 3.1.2s only; version 3.1.3as only; …
• Cisco IOS XE 3.2ja: version 3.2.0ja only
• Cisco IOS XE 3.3sg: version 3.3.0sg only; version 3.3.1sg only; version 3.3.2sg only
• Cisco IOS XE 3.3xo: version 3.3.0xo only; version 3.3.1xo only; version 3.3.2xo only
• Cisco IOS XE 3.4sg: version 3.4.0sg only; version 3.4.1sg only; version 3.4.2sg only; version 3.4.3sg only; version 3.4.4sg only; version 3.4.5sg only; …

Published 2016-10-05. Last modified 2026-06-17.