CVE-2009-0635

Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets.

• CWE-399

• http://secunia.com/advisories/34438Vendor Advisory
• http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90459.shtmlPatch, Vendor Advisory
• http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/34246
• http://www.securitytracker.com/id?1021895
• http://www.vupen.com/english/advisories/2009/0851Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49417
• http://secunia.com/advisories/34438Vendor Advisory
• http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90459.shtmlPatch, Vendor Advisory
• http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/34246
• http://www.securitytracker.com/id?1021895
• http://www.vupen.com/english/advisories/2009/0851Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49417

Published

Mar 27, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-0629The (1) Airline Product Set (aka ALPS), (2) Serial Tunnel Co…
• CVE-2009-0630The (1) Cisco Unified Communications Manager Express; (2) SI…
• CVE-2009-0631Unspecified vulnerability in Cisco IOS 12.0 through 12.4, wh…
• CVE-2009-0632The IP Phone Personal Address Book (PAB) Synchronizer featur…
• CVE-2009-0633Multiple unspecified vulnerabilities in the (1) Mobile IP NA…
• CVE-2009-0634Multiple unspecified vulnerabilities in the home agent (HA) …
• CVE-2009-0636Unspecified vulnerability in Cisco IOS 12.0 through 12.4, wh…
• CVE-2009-0637The SCP server in Cisco IOS 12.2 through 12.4, when Role-Bas…
• CVE-2009-0638The Cisco Firewall Services Module (FWSM) 2.x, 3.1 before 3.…
• CVE-2009-0639PHP remote file inclusion vulnerability in moduli/libri/inde…
• CVE-2009-0640Directory traversal vulnerability in the administrative web …
• CVE-2009-0641sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x v…