CVE-2016-6392: Cisco IOS

High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days.

Cisco IOS 12.2 and 15.0 through 15.3 and IOS XE 3.1 through 3.9 allow remote attackers to cause a denial of service (device restart) via a crafted IPv4 Multicast Source Discovery Protocol (MSDP) Source-Active (SA) message, aka Bug ID CSCud36767.

Affected products

• Cisco IOS: version 12.2(33)cx only; version 12.2(33)cy only; version 12.2(33)cy1 only; version 12.2(33)ira only; version 12.2(33)irb only; version 12.2(33)irc only; …
• Cisco IOS XE: version 3.1.0s only; version 3.1.1s only; version 3.1.2s only; version 3.1.3as only; version 3.1.4as only; version 3.1.4s only; …

Published 2016-10-05. Last modified 2026-06-17.