CVE-2006-4650
Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes...
Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet during decapsulation, which leads to an integer overflow that references data from incorrect memory locations, which allows remote attackers to inject crafted packets into the routing queue, possibly bypassing intended router ACLs.
Exploit likelihood
What each source reports
NVD Score used
Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet during decapsulation, which leads to an integer overflow that references data from incorrect memory locations, which allows remote attackers to inject crafted packets into the routing queue, possibly bypassing intended router ACLs.
- Record
CVE-2006-4650- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet during decapsulation, which leads to an integer overflow that references data from incorrect memory locations, which allows remote attackers to inject crafted packets into the routing queue, possibly bypassing intended router ACLs.
- Record
CVE-2006-4650- Updated
- 2026-11-02
EUVDEUVD-2006-4638 No score
Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet during decapsulation, which leads to an integer overflow that references data from incorrect memory locations, which allows remote attackers to inject crafted packets into the routing queue, possibly bypassing intended router ACLs.
- Record
EUVD-2006-4638- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-522v-5cvx-8x8h No score
Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes...
Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet during decapsulation, which leads to an integer overflow that references data from incorrect memory locations, which allows remote attackers to inject crafted packets into the routing queue, possibly bypassing intended router ACLs.
- Record
GHSA-522v-5cvx-8x8h- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-4650 is a low vulnerability (CVSS 2.6) in Cisco Ios, published September 9, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.23%, the 88th percentile. No source names a fixed version.
References
vupen.com/english/advisories/2006/3502
securitytracker.com/id?1016799
osvdb.org/28590
securityfocus.com/archive/1/445322/100/0/threaded
phenoelit.de/stuff/CiscoGRE.txt
secunia.com/advisories/21783
Show 7 moreShow less
securityreason.com/securityalert/1526
cisco.com/en/US/tech/tk827/tk369/tsd_technology_security_response09186a008072cd7b.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5713
exchange.xforce.ibmcloud.com/vulnerabilities/28786
nvd.nist.gov/vuln/detail/CVE-2006-4650
github.com/advisories/GHSA-522v-5cvx-8x8h