CVE-2004-1464: Cisco IOS Denial-of-Service Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 19 May 2023, 6,669 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 4.8%
EPSS score, percentile 92 of all scored records
- How severe?
- 5.9 Medium
CVSS v3.1 base score, from CISA's enrichment of the record
- What should I do?
CISA deadline 9 Jun 2023. Apply updates per vendor instructions.
- Which versions are affected?
Not stated. The CVE record gives vendor and product as “n/a” and the version as “unspecified”.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply updates per vendor instructions.
CISA due date for this action: 9 June 2023.
Advisories and patches
Linked from CISA's catalog entry
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040827-telnet
- https://nvd.nist.gov/vuln/detail/CVE-2004-1464
Affected products and versions
The CVE record does not name affected products or versions: vendor and product are “n/a” and the version is “unspecified”.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2004-1464 to its Known Exploited Vulnerabilities (KEV) catalog on 19 May 2023.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 9 Jun 2023.
- The CVE record was published on 13 Feb 2005, 6,669 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 5.9 (Medium), taken from CISA's enrichment of the record.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 4.8% (percentile 92), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact partial.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or reverse Telnet port.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
- CWE-400: Uncontrolled Resource Consumption
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 13 Feb 2005 | CVE record published |
| 19 May 2023 | Added to CISA KEV |
| 9 Jun 2023 | CISA due date for the required action |
| 22 Oct 2025 | CVE record last updated |
References
More exploited Cisco vulnerabilities
- CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
- CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
- CVE-2026-76460: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
- CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability
- CVE-2026-20079: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability