Cisco switch software vulnerable

IOS XE 16.1.1 for Catalyst 3850, 3650 could allow attackers to reload devices

network switches ethernet cables
Credit: Jon 'ShakataGaNai' Davis/Wikipedia

Cisco this week issued a security advisory on a vulnerability in its IOS XE software. IOS XE Release 16.1.1 could allow an attacker to cause an affected device to reload.

The vulnerability is due to incorrect processing of packets that have a source MAC address of 0000:0000:0000, the advisory states. An attacker could exploit it by sending a frame that has a source MAC address of all zeros to an affected device.

A successful exploit could allow the attacker to cause the device to reload. All products that run IOS XE Release 16.1.1 are vulnerable, the advisory states. Two of those products are Cisco’s Catalyst 3850 and 3650 series switches.

Cisco has released software updates that address this vulnerability. There are no workarounds that mitigate it, the company says.

The Cisco Product Security Incident Response Team is not aware of any public announcements or malicious use of the vulnerability, the advisory states.

Earlier this week, Cisco said it was reviewing its products to ensure no backdoor corruptions, or “malicious modifications” exist after Juniper announced that its ScreenOS firewall operating system has been vulnerable for years.

More from Cisco Subnet:

Cisco shifting to a software model

Cisco adds programmability to Internet routers

Cisco CEO not big on spin-ins

Ex-Juniper sibs look to soften up the WAN

What's Juniper Networks to do?

Cisco, Ericsson team as industry consolidates

Users prepare for a software-driven world

Juniper disaggregates even further

PC storage waning, Cisco study finds

Cisco SDN user says just pick what you need

Follow Jim Duffy on Twitter

Must read: Hidden Cause of Slow Internet and how to fix it
View Comments
Join the discussion
Be the first to comment on this article. Our Commenting Policies