Intel

CVE-2016-6415

Cisco IOS, IOS XR, and IOS XE — Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability

criticalKEV: actively exploitedPoCEPSS 87%

Description

The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.

Source: CISA_KEVCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2016-6415 (BENIGNCERTAIN) carries an EPSS score of 87.3 % at the 99.8th percentile, meaning virtually no comparable CVE sees higher exploitation probability. The CVSS vector describes an unauthenticated, network-reachable attack requiring no user interaction, capable of extracting sensitive memory contents — potentially including IKE PSKs, session keys, and configuration fragments — directly from the device. For NIS2-scoped organisations running Cisco-based VPN infrastructure (energy, telecoms, finance), the risk is acute: a successful attack undermines the confidentiality of all traffic protected by the affected VPN and can serve as a precursor to man-in-the-middle attacks or network pivoting. CISA's addition to the KEV list in May 2023 — seven years after initial disclosure — confirms sustained active exploitation and should drive patch priority to "critical/immediate" regardless of whether the device is classified as legacy.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply Cisco's security patches immediately: fixes exist for IOS 12.2–12.4, 15.0–15.6, IOS XE through 3.18S, and IOS XR 4.3.x / 5.0.x–5.2.x — look up exact build numbers in Cisco Security Advisory bug IDs CSCvb29204 and CSCvb36055 and schedule the appropriate maintenance window.
  • Disable IKEv1 on all perimeter and core devices where only IKEv2-capable peers exist: crypto isakmp disable on IOS, or the equivalent IOS XE/XR configuration command.
  • Restrict UDP/500 and UDP/4500 (NAT-T) at the external firewall to explicitly permitted peer IP addresses — no open IKE exposure to the internet.
  • Treat all Pre-Shared Keys and certificate private keys on affected devices as potentially compromised and rotate them immediately; memory-disclosure attacks can extract key material directly from RAM.
  • Terminate active VPN sessions on affected devices and notify peer organisations of the incident to reduce session-hijacking exposure.
  • Isolate affected devices from the management network until patched; use out-of-band console or OOBM access to perform the patch operation.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Restrict IKEv1 traffic (UDP/500, UDP/4500) via ACL to known VPN peer addresses — whitelist approach: permit udp host <peer> any eq 500; drop everything else.
  • IPS/IDS signature: Enable Snort/Suricata rules targeting malformed IKEv1 SA requests with anomalous payload lengths (BENIGNCERTAIN pattern: short, incomplete initiator payloads); Cisco has published corresponding IPS signature updates — verify in the Cisco IPS Signature Update portal.
  • Enforce IKEv2: Where technically feasible, disable IKEv1 in the crypto policy and configure IKEv2-only with strong cipher suites (crypto ikev2 proposal).
  • Least privilege / AAA: Restrict management access to affected routers and switches to dedicated jump hosts; enforce TACACS+/RADIUS with MFA for all privileged accounts.
  • Configuration change logging: Enable archive log config on IOS to detect post-exploitation tampering with crypto configuration.

Runbook · Step 3

Detection rules

  • Network telemetry (Zeek/Suricata): Alert on IKEv1 packets with Exchange-Type 0x05 (Informational) or incomplete SA payloads from unauthorised source IPs — check Zeek isakmp.log for exchange_type and initiator_spi values shorter than 8 bytes.
  • Cisco syslog: Correlate %CRYPTO-4-IKMP_BAD_MESSAGE or %CRYPTO-6-IKMP_MODE_FAILURE messages; repeated occurrences from a single source IP indicate active scanning or exploitation.
    • SPL snippet: index=network sourcetype=cisco:ios "IKMP_BAD_MESSAGE" | stats count by src_ip | where count > 10
  • NetFlow/IPFIX: Flag unexpected UDP/500 flows from external IPs targeting management interfaces (loopback, OOBM) — baseline deviation above 3 sigma as alert threshold.
  • EDR / downstream systems: New credential use or lateral movement shortly after an IKEv1 anomaly event — Windows Event ID 4624 (Logon Type 3) from unknown sources as a correlation indicator.
  • Sigma rule shape (network log): 
    title: Cisco IKEv1 BENIGNCERTAIN Probe
logsource: { product: cisco, service: ios }
detection:
  keywords: ['IKMP_BAD_MESSAGE', 'IKMP_MODE_FAILURE']
condition: keywords

Metrics

Severity
critical
Priority score
163.28
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
99.7 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
87.3 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2023-05-19 00:00 UTC
CWE
—

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2016-6415