CVE-2009-0635
Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12...
Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets.
Exploit likelihood
What each source reports
NVD Score used
Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets.
- Record
CVE-2009-0635- CVSS 2.0
- 7.1 High
AV:N/AC:M/Au:N/C:N/I:N/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets.
- Record
CVE-2009-0635- Updated
- 2026-11-02
EUVDEUVD-2009-0638 No score
Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets.
- Record
EUVD-2009-0638- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jrx8-5mjp-vjpm No score
Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12...
Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets.
- Record
GHSA-jrx8-5mjp-vjpm- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0635 is a high vulnerability (CVSS 7.1) in Cisco Ios, published March 27, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.51%, the 84th percentile. No source names a fixed version.
References
cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml
secunia.com/advisories/34438
securityfocus.com/bid/34246
exchange.xforce.ibmcloud.com/vulnerabilities/49417
securitytracker.com/id?1021895
vupen.com/english/advisories/2009/0851
nvd.nist.gov/vuln/detail/CVE-2009-0635
github.com/advisories/GHSA-jrx8-5mjp-vjpm