CVE-2004-0551 in Catalyst CatOS
Summary
by MITRE
Cisco CatOS 5.x before 5.5(20) through 8.x before 8.2(2) and 8.3(2)GLX, as used in Catalyst switches, allows remote attackers to cause a denial of service (system crash and reload) by sending invalid packets instead of the final ACK portion of the three-way handshake to the (1) Telnet, (2) HTTP, or (3) SSH services, aka "TCP-ACK DoS attack."
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/12/2025
This vulnerability represents a critical denial of service flaw in Cisco Catalyst switches running CatOS versions between 5.x before 5.5(20) and 8.x before 8.2(2) and 8.3(2)GLX. The vulnerability specifically targets the TCP three-way handshake implementation within the switch's network services, making it particularly dangerous as it can be exploited remotely without authentication. The attack vector involves sending malformed TCP packets that omit the final ACK portion of the standard three-way handshake process, causing the affected services to crash and subsequently reload the system.
The technical implementation of this vulnerability stems from inadequate input validation within the TCP stack processing of the affected Cisco CatOS versions. When the Telnet, HTTP, or SSH services receive TCP packets that do not conform to the expected three-way handshake sequence, the system fails to properly handle these malformed packets and instead triggers a system crash. This behavior aligns with CWE-129, Input Validation, and CWE-20, Improper Input Validation, as the system does not properly validate TCP packet sequences before processing them. The vulnerability operates at the network protocol level, making it particularly insidious as it can be exploited against multiple service protocols simultaneously.
The operational impact of this vulnerability extends beyond simple service disruption, as it can cause complete system reloads that may last several minutes, effectively rendering the network switch unavailable for its intended purpose. Network administrators may experience extended downtime while systems restart, potentially affecting network connectivity and availability for critical business operations. The vulnerability affects a wide range of Cisco Catalyst switches including models 6000, 6500, and 3000 series, making it particularly concerning for enterprise networks that rely heavily on these devices. The attack can be executed from any remote location without requiring authentication, making it accessible to any potential attacker with network access.
Mitigation strategies for this vulnerability should include immediate deployment of Cisco's recommended security patches and updates to CatOS versions that address the TCP packet handling flaws. Network administrators should also consider implementing network access control lists to restrict access to Telnet, HTTP, and SSH services from untrusted networks. The vulnerability can be addressed through the implementation of TCP sequence number validation and proper error handling mechanisms that prevent malformed packets from causing system crashes. Organizations should also monitor network traffic for unusual patterns that may indicate exploitation attempts and implement intrusion detection systems that can identify and alert on malformed TCP packets. From an ATT&CK framework perspective, this vulnerability maps to T1499.004, Endpoint Denial of Service, and T1595.001, Network Denial of Service, as it represents a remote attack that can be executed against network infrastructure components. The vulnerability demonstrates the importance of proper protocol implementation and input validation in network security systems, highlighting that even fundamental network protocols can contain exploitable flaws when not properly implemented.