CVE-2014-2144 in IOS XR
Summary
by MITRE
Cisco IOS XR does not properly throttle ICMPv6 redirect packets, which allows remote attackers to cause a denial of service (IPv4 and IPv6 transit outage) via crafted redirect messages, aka Bug ID CSCum14266.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/09/2026
Cisco IOS XR software contains a critical vulnerability in its handling of ICMPv6 redirect packets that enables remote attackers to execute denial of service attacks against network infrastructure. This flaw exists within the protocol processing mechanisms of the IOS XR operating system, specifically in how it manages the rate at which ICMPv6 redirect messages are processed and forwarded through the network fabric. The vulnerability stems from insufficient throttling controls that allow an attacker to flood the system with crafted redirect packets, overwhelming the processing capabilities and causing legitimate traffic to be disrupted. The impact extends across both IPv4 and IPv6 transit networks, creating widespread service degradation that can affect critical network operations and connectivity.
The technical implementation of this vulnerability resides in the ICMPv6 processing stack where the system fails to enforce proper rate limiting controls on redirect message handling. Attackers can exploit this weakness by sending a high volume of specially crafted ICMPv6 redirect packets that trigger the system's inability to properly throttle incoming messages. This flaw operates at the network layer protocol level and affects the routing decision processes within the IOS XR platform, where redirect messages are used to inform hosts about better paths to reach destinations. The lack of proper packet rate limiting allows the system to process these messages without adequate resource controls, leading to exhaustion of processing capabilities and subsequent service disruption.
The operational impact of CVE-2014-2144 can be severe and far-reaching, potentially causing complete transit outages for both IPv4 and IPv6 traffic flowing through affected IOS XR devices. Network operators may experience widespread connectivity issues as the system becomes overwhelmed with redirect packet processing, resulting in routing table instability and forwarding failures. The vulnerability affects critical infrastructure components including core routers and service provider equipment where IOS XR is deployed, making it particularly dangerous in production environments. Attackers can leverage this weakness to create sustained denial of service conditions that may require system restarts or manual intervention to restore normal operations.
Mitigation strategies for this vulnerability should focus on implementing proper rate limiting controls and access control lists to restrict ICMPv6 redirect traffic. Network administrators should deploy ingress filtering to block unauthorized ICMPv6 redirect messages and configure proper throttling mechanisms within the IOS XR configuration. The Cisco recommended approach includes applying specific software patches and updates that address the rate limiting deficiencies in the ICMPv6 processing stack. Organizations should also implement monitoring solutions to detect unusual patterns of ICMPv6 redirect traffic and establish incident response procedures to handle potential exploitation attempts. This vulnerability aligns with CWE-770, which describes insufficient resource management, and maps to ATT&CK technique T1498 related to network denial of service attacks. The remediation process requires careful planning to avoid disrupting legitimate network operations while implementing the necessary security controls to protect against this specific threat vector.