CVE-2021-1620

Name: CVE-2021-1620
Creator: NVD / NIST
Published: 2021-09-23T03:15:13.03+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.7/10EPSS 1.03%

Last modified Jun 17, 2026

CVE-2021-1620 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. A vulnerability in the Internet Key Exchange Version 2 (IKEv2) support for the AutoReconnect feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to exhaust the free IP addresses from the assigned local pool. This vulnerability occurs because the code does not release the allocated IP address under certain failure conditions. EPSS estimates a 1.03% chance of exploitation in the next 30 days.

Description

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) support for the AutoReconnect feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to exhaust the free IP addresses from the assigned local pool. This vulnerability occurs because the code does not release the allocated IP address under certain failure conditions. An attacker could exploit this vulnerability by trying to connect to the device with a non-AnyConnect client. A successful exploit could allow the attacker to exhaust the IP addresses from the assigned local pool, which prevents users from logging in and leads to a denial of service (DoS) condition.

Metrics

CVSS 3.1

7.7/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

EPSS Probability

1.03%

59.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Cisco	Ios	12.2\(6\)i1
Cisco	Ios	15.1\(3\)svr1
Cisco	Ios	15.1\(3\)svr2
Cisco	Ios	15.1\(3\)svr3
Cisco	Ios	15.1\(3\)svs
Cisco	Ios	15.1\(3\)svs1
Cisco	Ios	15.1\(3\)svt1
Cisco	Ios	15.1\(3\)svt2
Cisco	Ios	15.1\(3\)svu1
Cisco	Ios	15.2\(1\)sy2
Cisco	Ios	15.2\(1\)sy3
Cisco	Ios	15.2\(1\)sy4
Cisco	Ios	15.2\(1\)sy5
Cisco	Ios	15.2\(1\)sy6
Cisco	Ios	15.2\(1\)sy7
Cisco	Ios	15.2\(1\)sy8
Cisco	Ios	15.2\(4\)e
Cisco	Ios	15.2\(4\)e1
Cisco	Ios	15.2\(4\)e2
Cisco	Ios	15.2\(4\)e3
Cisco	Ios	15.2\(4\)e4
Cisco	Ios	15.2\(4\)e5
Cisco	Ios	15.2\(4\)e5a
Cisco	Ios	15.2\(4\)e6
Cisco	Ios	15.2\(4\)e7
Cisco	Ios	15.2\(4\)e8
Cisco	Ios	15.2\(4\)e9
Cisco	Ios	15.2\(4\)e10
Cisco	Ios	15.2\(4\)e10a
Cisco	Ios	15.2\(4\)e10b
Cisco	Ios	15.2\(4\)ea
Cisco	Ios	15.2\(4\)ea1
Cisco	Ios	15.2\(4\)ea2
Cisco	Ios	15.2\(4\)ea3
Cisco	Ios	15.2\(4\)ea4
Cisco	Ios	15.2\(4\)ea5
Cisco	Ios	15.2\(4\)ea6
Cisco	Ios	15.2\(4\)ea7
Cisco	Ios	15.2\(4\)ea8
Cisco	Ios	15.2\(4\)ea9
Cisco	Ios	15.2\(4\)ea9a
Cisco	Ios	15.2\(4\)ec1
Cisco	Ios	15.2\(4\)ec2
Cisco	Ios	15.2\(4m\)e1
Cisco	Ios	15.2\(4m\)e2
Cisco	Ios	15.2\(4m\)e3
Cisco	Ios	15.2\(4n\)e2
Cisco	Ios	15.2\(4o\)e2
Cisco	Ios	15.2\(4o\)e3
Cisco	Ios	15.2\(4p\)e1

Showing 50 of 689 affected configurations. See NVD for the full list.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ikev2-ebFrwMPrPatch, Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ikev2-ebFrwMPrPatch, Vendor Advisory

Timeline

Published: Sep 23, 2021
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2021-1620?

How severe is CVE-2021-1620?

CVE-2021-1620 has a CVSS score of 7.7/10 (HIGH severity). The EPSS model estimates a 1.03% probability of exploitation in the next 30 days.

How do I fix CVE-2021-1620?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-1620?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST