{"id":"CVE-2016-6415","published":"2016-09-19T01:59:06Z","modified":"2026-06-17T00:50:59Z","title":"Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability","vendor":"Cisco","product":"IOS, IOS XR, and IOS XE","tier":"core","eol":null,"description":{"text":"The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.","provenance":"source","from":"NVD"},"summary":{"text":"Cisco IOS, IOS XE, IOS XR, and PIX devices contain a flaw in the server-side IKEv1 implementation, which handles Internet Key Exchange negotiation. A remote attacker who can send a Security Association negotiation request to the affected IKEv1 service can obtain sensitive information from the device's memory, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:02Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.87687,"percentile":0.99758,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2023-05-19","dueDate":"2023-06-09","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1; https://nvd.nist.gov/vuln/detail/CVE-2016-6415","provenance":"source"},"vulncheckKev":{"dateAdded":"2016-09-28","exploitedFirstSeen":"2016-09-28","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/ncas/alerts/TA16-250A","date":"2016-09-28"},{"url":"https://cisa.gov/news-events/alerts/2015/08/01/recent-email-phishing-campaigns-mitigation-and-response","date":"2016-09-29"},{"url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=a9c54f79-d780-437b-a7f5-a74960e299d5&CommunityKey=8af7f28f-02f1-4107-8639-93a60b6546d4&tab=librarydocuments","date":"2017-06-20"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-05-19"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/93003","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1036841","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/93003","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1036841","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6415","tags":["US Government Resource"]}],"techniques":[{"id":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated exploitation of exposed IKEv1 service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to obtain sensitive information from device memory","start":165,"end":239}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Reads sensitive data from device memory","mappingType":"primary_impact","evidence":[{"from":"description","quote":"obtain sensitive information from device memory","start":192,"end":239}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2016-7338","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-7338","exploited":true,"exploitedSince":"2023-05-19","provenance":"source"},"exploits":[{"id":43383,"url":"https://www.exploit-db.com/exploits/43383","title":"Cisco IOS 12.2 < 12.4 / 15.0 < 15.6 - Security Association Negotiation Request Device Memory","type":"remote","platform":"hardware","date":"2017-03-17","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2017-03-17"},"pocGithub":{"count":1,"skipped":0,"earliest":"2020-11-04","earliestUrl":"https://github.com/3ndG4me/CVE-2016-6415-BenignCertain-Monitor","repos":[{"name":"3ndG4me/CVE-2016-6415-BenignCertain-Monitor","url":"https://github.com/3ndG4me/CVE-2016-6415-BenignCertain-Monitor","stars":11,"created":"2020-11-04"}]},"metasploit":[{"name":"Cisco IKE Information Disclosure","module":"auxiliary/scanner/ike/cisco_ike_benigncertain","type":"auxiliary","disclosureDate":"2016-09-29","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ike/cisco_ike_benigncertain.rb"}],"first":{"date":"2016-09-29","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ike/cisco_ike_benigncertain.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"},{"stage":"related","techniques":["T1212"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2016-09-19","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6415","provenance":"source"},{"date":"2016-09-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/ncas/alerts/TA16-250A","provenance":"source"},{"date":"2016-09-29","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2017-03-17, PoC-in-GitHub 2020-11-04","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ike/cisco_ike_benigncertain.rb","provenance":"source"},{"date":"2023-05-19","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-05-19","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-7338","provenance":"source"}],"speed":{"daysToPublicExploit":10,"firstExploitFrom":"Metasploit","daysToKev":2433},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3683 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9976"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}