{"id":"CVE-2004-1464","published":"2004-12-31T05:00:00Z","modified":"2026-06-16T22:07:45Z","title":"Cisco IOS Denial-of-Service Vulnerability","vendor":"Cisco","product":"IOS","tier":"core","eol":null,"description":{"text":"Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or reverse Telnet port.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an uncontrolled resource consumption issue in the Telnet and reverse Telnet handling of Cisco IOS 12.2(15) and earlier, which the affected devices expose through their TCP services. A remote attacker can send a crafted TCP connection to the Telnet or reverse Telnet port, without authentication or user interaction, to exhaust VTY resources and cause refused VTY connections, though the attack is rated as having high complexity.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:23Z"},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.0484,"percentile":0.91974,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2023-05-19","dueDate":"2023-06-09","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040827-telnet; https://nvd.nist.gov/vuln/detail/CVE-2004-1464","provenance":"source"},"vulncheckKev":{"dateAdded":"2006-08-27","exploitedFirstSeen":"2006-08-27","ransomware":false,"evidence":[{"url":"https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20040827-telnet.html","date":"2006-08-27"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-05-19"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"http://secunia.com/advisories/12395/","tags":["Broken Link","Vendor Advisory"]},{"url":"http://securitytracker.com/id?1011079","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.cisco.com/warp/public/707/cisco-sa-20040827-telnet.shtml","tags":["Not Applicable","Vendor Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/384230","tags":["Patch","Third Party Advisory","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/11060","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17131","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://secunia.com/advisories/12395/","tags":["Broken Link","Vendor Advisory"]},{"url":"http://securitytracker.com/id?1011079","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.cisco.com/warp/public/707/cisco-sa-20040827-telnet.shtml","tags":["Not Applicable","Vendor Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/384230","tags":["Patch","Third Party Advisory","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/11060","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17131","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2004-1464","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote network exploitation of exposed Telnet service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to cause a denial of service","start":31,"end":83}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499","name":"Endpoint Denial of Service","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Denial of service exhausting VTY connections","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to cause a denial of service","start":31,"end":83}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2004-1458","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2004-1458","exploited":true,"exploitedSince":"2023-05-19","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1499"],"provenance":"ai"}],"timeline":[{"date":"2004-12-31","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2004-1464","provenance":"source"},{"date":"2006-08-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20040827-telnet.html","provenance":"source"},{"date":"2023-05-19","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-05-19","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2004-1458","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":6713},"priority":{"score":60.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 7368 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.39,"detail":"percentile 0.9197"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.13,"detail":"base score 5.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}