CVE-2016-1399

Vulnerability

The vulnerability resides in the packet-processing microcode of Cisco IOS Software on Industrial Ethernet 4000 Series Switches (versions 15.2(2)EA, 15.2(2)EA1, 15.2(2)EA2, and 15.2(4)EA) and Industrial Ethernet 5000 Series Switches (versions 15.2(2)EB and 15.2(2)EB1). It also affects Rockwell Automation Allen-Bradley Stratix 5400 and 5410 switches that run the same firmware [1][2]. The bug is triggered by improper processing of certain ICMP IPv4 packets.

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability by sending specially crafted ICMP IPv4 packets to an affected device. No user interaction or special network position is required. The malicious packet corrupts the packet enqueued immediately after it in the device's processing queue [2].

Impact

Successful exploitation causes packet data corruption, which can disrupt control traffic (e.g., ARP) or traffic transiting the device. This leads to a denial-of-service condition that may affect industrial control system operations [1][2].

Mitigation

Cisco has released software updates that address this vulnerability; affected users should upgrade to a fixed Cisco IOS release [2]. Rockwell Automation has also produced new firmware for the Stratix 5400 and 5410 switches [1]. No workarounds are available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.